AIKIDO-2026-76686

roots/wordpress is vulnerable to Cross-Site Scripting (XSS)

CVE-2026-64638Published Aug 10, 2026

CVE Score

High

Cross-Site Scripting (XSS)

TL;DR

The WordPress login screen reflects attacker-controlled input without adequate escaping, allowing pre-authentication reflected cross-site scripting. Through a crafted third-party page and successful social engineering, that XSS can be escalated to PHP code execution under conditions outside the attacker's control. The fix escapes the reflected login-screen values so the payload cannot run in the victim's browser.

How do I fix this?

Upgrade the roots/wordpress library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and users can be induced to visit an attacker-controlled page that targets the WordPress login screen.

Package

roots/wordpress

Versions

3.7.38 - 5.2.24

Fixed in 5.2.25

5.3 - 5.3.21

Fixed in 5.3.22

5.4 - 5.4.19

Fixed in 5.4.20

5.5 - 5.5.18

Fixed in 5.5.19

5.6 - 5.6.17

Fixed in 5.6.18

5.7 - 5.7.15

Fixed in 5.7.16

5.8 - 5.8.13

Fixed in 5.8.14

5.9 - 5.9.13

Fixed in 5.9.15

6.0 - 6.0.12

Fixed in 6.0.13

6.1 - 6.1.10

Fixed in 6.1.11

6.2 - 6.2.9

Fixed in 6.2.10

6.3 - 6.3.8

Fixed in 6.3.9

6.4 - 6.4.8

Fixed in 6.4.9

6.5 - 6.5.8

Fixed in 6.5.9

6.6 - 6.6.5

Fixed in 6.6.6

6.7 - 6.7.5

Fixed in 6.7.6

6.8 - 6.8.6

Fixed in 6.8.7

6.9 - 6.9.5

Fixed in 6.9.6

7.0 - 7.0.2

Fixed in 7.0.3

Background info

roots/wordpress is vulnerable to Cross-Site Scripting (XSS) in versions 7.0 - 7.0.2, 6.9 - 6.9.5, 6.8 - 6.8.6, 6.7 - 6.7.5, 6.6 - 6.6.5, 6.5 - 6.5.8, 6.4 - 6.4.8, 6.3 - 6.3.8, 6.2 - 6.2.9, 6.1 - 6.1.10, 6.0 - 6.0.12, 5.9 - 5.9.13, 5.8 - 5.8.13, 5.7 - 5.7.15, 5.6 - 5.6.17, 5.5 - 5.5.18, 5.4 - 5.4.19, 5.3 - 5.3.21 and 3.7.38 - 5.2.24.

CVE Score

High

Cross-Site Scripting (XSS)

Are you affected? Scan for Free