All vulnerabilities

WordPress core

CVE-2026-64638

Pre-auth reflected XSS on login screen with potential to lead to PHP code execution

Severity: High 8.9
Published: 6 Aug 2026
Last changed: 6 Aug 2026
Added to UpHeron: 17 Oct 2026
Fixed in: 6.5.9, 6.6.6, 6.7.6, 6.8.7, 6.9.6, 7.0.3
Also known as: GHSA-52p2-r8wf-jcrf
Sources: WordPress

Affected software

Software Affected versions

WordPressWordPress core · cpe:a:wordpress:wordpress

From 7.0.0 before 7.0.3
From 6.9.0 before 6.9.6
From 6.8.0 before 6.8.7
From 6.7.0 before 6.7.6

All 24 release lines

From 4.7.0 before 4.7.34
From 4.8.0 before 4.8.29
From 4.9.0 before 4.9.30
From 5.0.0 before 5.0.26
From 5.1.0 before 5.1.23
From 5.2.0 before 5.2.25
From 5.3.0 before 5.3.22
From 5.4.0 before 5.4.20
From 5.5.0 before 5.5.19
From 5.6.0 before 5.6.18
From 5.7.0 before 5.7.16
From 5.8.0 before 5.8.14
From 5.9.0 before 5.9.14
From 6.0.0 before 6.0.13
From 6.1.0 before 6.1.11
From 6.2.0 before 6.2.10
From 6.3.0 before 6.3.9
From 6.4.0 before 6.4.9
From 6.5.0 before 6.5.9
From 6.6.0 before 6.6.6
From 6.7.0 before 6.7.6
From 6.8.0 before 6.8.7
From 6.9.0 before 6.9.6
From 7.0.0 before 7.0.3

References

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-64638
GitHub Advisory Database https://github.com/advisories/GHSA-52p2-r8wf-jcrf
WordPress security advisory https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-52p2-r8wf-jcrf