Blog A login-screen XSS in WordPress 7.0.3 and a plugin backdoor
A login-screen XSS in WordPress 7.0.3 and a plugin backdoor
WordPress 7.0.3 fixes a pre-authentication reflected XSS on the login screen. A hardcoded backdoor shipped in one Advanced Responsive Video Embedder release, and The Events Calendar patched an author-level file read.
The core release is where the eye goes first. WordPress 7.0.3 fixes CVE-2026-64638, a pre-authentication reflected cross-site scripting flaw on the login screen, scored 8.9. The NVD writeup notes that under conditions the attacker does not control — successful social engineering that gets a target to click through from a malicious third-party site — the reflection can be walked up into remote code execution. Patched in 7.0.3.
The two words to hold onto are pre-auth and login screen. No session is needed to trigger the reflection, which puts every site with a reachable wp-login.php on the list. Auto-updates will carry most installs through this on their own; the sites at risk are the ones where core updates are gated — staging clones frozen against a client sign-off, managed hosts that batch releases, hardened builds that pin versions on purpose.
The advanced-responsive-video-embedder plugin shipped a hardcoded backdoor in version 10.8.7. The directory listing currently shows 10.9.4 with roughly 20,000 active installs. Anyone still sitting on 10.8.7 has attacker-controlled code inside an active plugin directory — no missing files, no odd cron entries, nothing at the network edge, just an extra path through a file that is supposed to be there.
the-events-calendar, installed on roughly 600,000 sites, patched an authenticated arbitrary file read reached through ajax_create_import. Author role is the bar, which narrows the exposed population to sites that hand author accounts out freely — membership sites, multi-author publications, event marketplaces — but on those sites any author can read whatever the PHP worker can read. wp-config.php is the obvious first stop, and once database credentials are on the outside of the server the rest of the incident writes itself.
The video-embedder case is the shape of finding a signature-only scanner tends to miss: the malicious code lives inside a legitimate plugin file, not in a dropped payload the operator can grep for by name. Catching it means reading what the plugin actually does at runtime, not just checking which files exist.
Tags: #wordpress , #cve , #plugin , #exploit