Loading vulnerability…
CVE-2026-64638 is a pre-authentication reflected cross-site scripting vulnerability in the WordPress login screen affecting WordPress versions prior to 7.0.3, with fixes backported through the 4.7 security branch. The flaw arises from inconsistent handling of a failed-login username value across multiple sanitization and HTML parsing stages. Research indicates the username is processed through functions including sanitize_user() and wp_strip_all_tags(), which relies on PHP strip_tags(), allowing certain tag-like input patterns to survive as text. The same value is later passed through wp_kses_post(), whose parser can reinterpret the input as permitted HTML, resulting in attacker-controlled DOM injection on the failed-login page. Because the issue is reachable before authentication, an attacker can trigger JavaScript execution in a victim’s browser by causing a crafted login failure page to be rendered. Researchers further demonstrated that the injected DOM can interact with WordPress login-page JavaScript and be chained into same-origin script execution and, under additional conditions, PHP code execution on the server.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A high-severity reflected XSS vulnerability in WordPress Core's login page caused by parser inconsistencies between sanitization routines; researchers showed it can be chained through browser-side techniques and legitimate WordPress features into server-side PHP code execution under specific conditions.
A high-severity pre-authentication reflected XSS vulnerability in the WordPress login screen that affects all supported WordPress versions and can be chained, under additional conditions and user interaction, into PHP code execution on the server.
A high-severity pre-authentication reflected XSS vulnerability in WordPress Core before 7.0.3, triggered via username HTML injection on wp-login.php.
A pre-auth reflected XSS vulnerability in the WordPress login screen that could potentially lead to PHP code execution.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.