New Word Press Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP
WordPress patched a pre-authentication reflected XSS in its login screen, tracked as CVE-2026-64638 with a CVSS score of 8.9, affecting every version of the CMS; the fix shipped August 6 in WordPress 7.0.3 with backports through the 4.7 branch. Researchers...