Pre-authentication reflected XSS in WordPress wp-login.php (CVE-2026-64638).
The flaw exploits a parser differential between PHP strip_tags() and
WordPress KSES. Tags with whitespace after < (e.g. "< area") survive
strip_tags() but are normalized to valid HTML by KSES, leading to
attacker-controlled DOM elements that trigger automatic JavaScript
execution via user-profile.js. No user interaction required.
Affects all WordPress versions < 7.0.3.
登录后查看神龙缓存的 POC 文件快照
登录查看