漏洞描述
Pre-authentication reflected XSS in WordPress wp-login.php (CVE-2026-64638). The flaw exploits a parser differential between PHP strip_tags() and WordPress KSES. Tags with whitespace after < (e.g. "< area") survive strip_tags() but are normalized to valid HTML by KSES, leading to attacker-controlled DOM elements that trigger automatic JavaScript execution via user-profile.js. No user interaction required. Affects all WordPress versions < 7.0.3.
影响产品
暂无结构化产品信息。
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。