CVE-2026-64638

COMPONENT VERSION RANGE

NewScan fingerprints WordPress from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-08-08. A tag with whitespace after the '<' (`< area`) survives PHP strip_tags() but is normalised back to real HTML by KSES, so the log= parameter on the login form lands attacker-controlled elements in the DOM and user-profile.js fires them - no authentication and no click. Version range and fixed_in are ground truth from the WordPress 7.0.3 release post + the MIT nuclei template (http/cves/2026/CVE-2026-64638.yaml, verified: true), not from the CVE prose. DELIBERATELY gated to the 7.0 branch only, even though the advisory says 'all versions < 7.0.3': WordPress backported this to every branch still eligible for security fixes (currently down to 4.7) and had not published those version numbers at fix time, so a flat `lt: 7.0.3` would have flagged every patched 6.9.x / 6.8.x / 5.x install as vulnerable - a false positive on an up-to-date site, which is worse than no gate. Widen this row per branch as the backport numbers land. Version source is the same one the two CVE-2026-63030 rows above already use, so the join is proven rather than assumed.