Parser-Differential

WordPress — Pre-Auth XSS to RCE Chain via Login Page Parser Differential (CVE-2026-64638, "XSS2Shell")

CVE-2026-64638 — nicknamed XSS2Shell by its discoverers at pwn.ai — is a pre-authentication reflected XSS in the WordPress login page that chains through five to seven stages into full remote code execution on the server. It is one of the most impactful…