XSS2Shell is a critical vulnerability chain in WordPress Core (tracked as CVE-2026-64638) that escalates a pre-authentication reflected Cross-Site Scripting (XSS) bug into full Remote Code Execution (RCE). Discovered by the security team at pwn.ai and disclosed in August 2026, the flaw allows an unauthenticated attacker to inject malicious JavaScript into the WordPress login page via a failed login attempt.
The attack chain operates through several stages:
- Initial XSS: A crafted username submitted to wp-login.php triggers a reflected XSS vulnerability due to inconsistent parsing between WordPress sanitizers.
- Escalation: The injected JavaScript interacts with the WordPress REST API and uses DOM clobbering to hijack internal requests.
Credential Theft: Against a logged-in administrator, the chain steals an Application Password via Same Origin Method Execution (SOME). - RCE: The attacker uses the stolen credentials to upload a malicious plugin, achieving PHP code execution on the server.
The vulnerability affects all supported WordPress versions from 4.7 up to 7.0.2. WordPress released an emergency patch in version 7.0.3 on August 6, 2026, which included backports to all maintained branches. While the initial XSS requires no authentication, the full RCE chain requires a logged-in administrator to visit an attacker-controlled page, making it a high-severity (CVSS 8.9) but targeted threat rather than a zero-click exploit.