One comment field.
Full server takeover.

A simple stored XSS bug in WordPress, now tracked as CVE-2026-64638, was just chained into complete remote code execution. No login. No plugin. Just a comment box nobody thought twice about, and given how much of the web runs on WordPress, that's a problem for a lot of people.

Could you spot a chain like this before it gets weaponized against a site you're responsible for?

That's exactly why we built a room around this one:

XSS2Shell: CVE-2026-64638

It walks you through the full chain, from a single comment field to shell access, step by step.

One comment field.Full server takeover.

One comment field.
Full server takeover.