CVE-2026-64638

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).

We have discovered 7,982,646 live websites that are affected by CVE-2026-64638.

Run a Free Instant Scan



Affected Software

Product  WordPress
Category Content Management System
Vulnerable Domains7,982,646 live websites (100% of WordPress install base)
Vulnerable Versions
  • from 0 through 7.0.3
Vulnerable Versions Count1,384 versions ( 93% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Aug 7, 2026
  • Updated - Aug 7, 2026

Credits

  • Pwn.ai (finder)

Website Distribution by Country

Number of websites using CVE-2026-64638
United States2,514,620 websites


Germany809,195 websites
Japan468,296 websites
GB350,408 websites
France344,215 websites
Italy312,276 websites
Netherlands255,328 websites
Russia203,560 websites
Poland203,058 websites
Spain196,253 websites

Website Distribution by TLD

Number of websites using CVE-2026-64638
.com3,445,220 websites
.de513,332 websites
.org409,162 websites
.net236,135 websites
.nl221,279 websites
.it212,922 websites
.co.uk196,593 websites
.ru171,101 websites
.pl153,011 websites
.fr148,965 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-64638

Top websites that are affected by CVE-2026-64638. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*********.com United States**
********.*********.com United States**
***************.org United States***
******.net United States***
************.org Singapore***
*****************.com United States***
****.br Brazil***
**********.com United States***
*********.de Germany***
****.io France***
See full domain list

FAQ

CVE-2026-64638 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WordPress
A total of 7,982,646 websites have been identified as vulnerable to CVE-2026-64638, based on global website indexing conducted by WebTechSurvey.
The WordPress is affected by the CVE-2026-64638 vulnerability.
WordPress versions up to and including 7.0.3 are vulnerable to CVE-2026-64638.