WordPress patches pre-auth login XSS that can lead to code execution
A pre‑authentication reflected XSS in WordPress’s login screen (CVE‑2026‑64638) lets an attacker inject script that, when a logged‑in admin clicks the link, can be chained to remote PHP code execution. The flaw affects all versions and is fixed in 7.0.3 and back‑ported to older releases.