SecurityQuiet 91d · day 96
WordPress XSS2Shell flaw enables full server takeover via login page
A vulnerability in WordPress allows attackers to escalate from cross-site scripting to remote code execution and admin account compromise.
What to know
- A WordPress vulnerability called XSS2Shell chains a login page XSS flaw into remote code execution and full server compromise.
- The flaw allows attackers to gain administrative access and execute arbitrary code on vulnerable WordPress installations.
- WordPress developers have patched the vulnerability as of August 13, 2026.
“WordPress 'XSS2Shell' flaw allows admin takeover and remote code execution”
SC Media · SC Media ↗ · Aug 13, 2:05 AM
WordPress developers Vendor
The record 3 articles and posts · last 30 days