WordPress Login Pages Become Browser-Side Entry Points
A public WordPress login page is not a low-risk screen. If it is unpatched, a crafted link can make the page run attacker-controlled script in the victim’s browser before anyone logs in, so the usual “no account access” filter misses the real blast radius.
WordPress fixed CVE-2026-64638, a pre-auth reflected XSS on the login screen, across core branches from 7.0.3 down to 4.7.34. The affected releases include 7.0, 6.9, 6.8, 6.7, 6.6, 6.5, 6.4, 6.3, 6.2, 6.1, 6.0, 5.9, 5.8, 5.7, 5.6, 5.5, 5.4, 5.3, 5.2, 5.1, 5.0, 4.9, 4.8, and 4.7, with each line patched to the version listed in the advisory.
That turns the login page into a victim-assisted path to phishing, admin-action abuse, or other browser-side compromise. For exposed sites, the risk starts at the public edge and stays there until the core version is updated.