THREAT OPS › Threat News › XSS2Shell (CVE-2026-64638): Patch WordPress Now
XSS2Shell (CVE-2026-64638): Patch WordPress Now
<h1>XSS2Shell (CVE-2026-64638): Patch WordPress Now</h1> <p>A new WordPress Core vulnerability chain called <strong>XSS2Shell</strong> turns a login page XSS bug into a much more serious risk for exposed WordPress sites. The issue is tracked as <strong>CVE-2026-64638</strong> and affects a broad range of supported WordPress versions before the latest security updates.</p> <p>The risk starts on the
MITRE ATT&CK techniques
Indicators of compromise
- CVE-2026-64638cve
- https://wordpress.org/news/2026/08/wordpress-7-0-3-release/url
- https://pwn.ai/blog/xss2shellurl
Original source: https://socradar.io/blog/xss2shell-cve-2026-64638-wordpress/