WordPress is vulnerable to a pre-authentication reflected cross-site scripting flaw that poses a critical risk of account takeover and session compromise.

This is a reflected cross-site scripting (XSS) vulnerability located on the login page. The flaw allows an unauthenticated attacker to inject malicious scripts into the application, which execute when a victim interacts with a crafted URL.

Successful exploitation permits attackers to hijack user sessions, steal administrative cookies, or redirect users to malicious sites. Given the CVSS score of 8.9, this vulnerability represents a high risk to organizational integrity, as it facilitates unauthorized access and potential data exfiltration.

Immediate Action: Update all WordPress installations to version 7.0.3 or later immediately.

Proactive Monitoring: Audit web server access logs for suspicious URL parameters containing script tags targeting the login endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block reflected XSS payloads at the perimeter.

Public Exploit Available: Yes, multiple public proof-of-concept repositories exist on GitHub.

The presence of public proof-of-concept code elevates the urgency of this update. Administrators must prioritize patching WordPress instances to version 7.0.3 to prevent potential account takeovers and session hijacking attempts.