XSS2Shell: Pre-Auth, No Account, Full Chain
XSS2Shell: Pre-Auth, No Account, Full Chain CVE-2026-64638 · CVSS 8.9 · High · Patched: WordPress 7.0.3 (6 Agustus 2026) · Disclosed: 7 Agustus 2026. Pre-authentication reflected XSS di wp-login.php yang bisa dichain sampai PHP...