Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
1 IOC
WordPress XSS2Shell Flaw Lets Unauthenticated Attackers Gain Remote Code Execution
Excerpt
A newly disclosed CVE-2026-64638, a pre-authentication cross-site scripting flaw in WordPress Core’s login screen that can be chained into full server-side remote code execution, earning a CVSS score of 8.9 and the codename XSS2Shell. PwnAI Research found that inserting a space between an opening angle bracket and a tag name (e.g., < area ) causes PHP’s strip_tags() parser to treat the string as harmless text. The bug begins on the ordinary login page. When a…
Read the original report →Indicators of Compromise
Open the mindmap →1 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-64638 | Medium | Score 57/100 | First seen |
IOC Relationship Graph
Building graph…