Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

GCP Compute Engine Security

JVN Japan

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

CVE-2026-64638 is a high-severity pre-authentication reflected cross-site scripting (XSS) vulnerability in WordPress login pages that can lead to remote code execution (RCE) under specific conditions. The flaw allows attacker-controlled JavaScript to execute in the browser of a visitor after a failed login attempt. Exploitation requires a logged-in administrator to interact with an attacker-controlled page, potentially enabling PHP code execution on the server. The vulnerability affects default WordPress installations and was patched in WordPress 7.0.3 and backported to versions back through 4.7. Versions older than 4.7 remain vulnerable. WordPress recommends immediate updating, and automatic background updates should apply the patch automatically. No in-the-wild exploitation has been reported as of the advisory date.

CVE-2026-64638 is a reflected XSS vulnerability on the WordPress login page that requires no authentication to trigger the initial script execution. The vulnerability arises from inconsistent sanitization of the username parameter on failed login attempts, allowing attacker-controlled HTML elements to be injected into the DOM. This injected content interacts with WordPress's user-profile.js script, enabling an attacker to hijack same-origin REST requests and execute JavaScript in the site's origin. Researchers demonstrated multiple attack chains from this XSS to PHP code execution, including creating Application Password credentials and uploading malicious plugins without needing to activate them. The vulnerability was responsibly disclosed and patched in WordPress 7.0.3, with backports to versions 4.7 and later. Exploitation requires social engineering to get an administrator to click a malicious link while logged in. The flaw does not require unusual hosting configurations and affects default installations.

Detailed information about New WordPress Pre-Auth XSS (CVE-2026-64638) Could Lead to RCE: Have you patched your instances yet?. Get real-time updates, technical

New WordPress Pre-Auth XSS (CVE-2026-64638) Could Lead to RCE: Have you patched your instances yet? - Live Threat Intelligence - Threat Radar | OffSeq.com

Hi everyone, A high-severity security issue was recently fixed in WordPress 7.0.3 (and backported to older versions). The vulnerability, tracked as CVE-2026-64638, is a pre-authentication reflected XSS flaw on the login page, discovered by the team at pwn.ai. Under specific conditions, if an administrator clicks a malicious link, it could potentially lead to PHP code execution. Given how widely WordPress is used across enterprise environments, this is definitely something sysadmins and security teams should keep on their radar. Source / Read more here:<a href="https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html">https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html</a> Are you relying on automatic background updates for this, or manually patching across your environments? How are your WAFs handling login page traffic?

Hi everyone,
 A high-severity security issue was recently fixed in WordPress 7.0.3 (and backported to older versions). The vulnerability, tracked as CVE-2026-64638, is a pre-authentication reflected XSS flaw on the login page, discovered by the team at pwn.ai. Under specific conditions, if an administrator clicks a malicious link, it could potentially lead to PHP code execution.
 Given how widely WordPress is used across enterprise environments, this is definitely something sysadmins and security teams should keep on their radar.
 Source / Read more here:https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html
 Are you relying on automatic background updates for this, or manually patching across your environments? How are your WAFs handling login page traffic?

New WordPress Pre-Auth XSS (CVE-2026-64638) Could Lead to RCE: Have you patched your instances yet?

Reddit Discussion: New WordPress Pre-Auth XSS (CVE-2026-64638) Could Lead to RCE: Have you patched your instances yet?

Threats Tagged 'ubuntu-cve-2026-64638'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'ubuntu-cve-2026-64638'

Lead Pen Test Professional