Footer

Your go-to destination for discovering trending open-source projects and uncovering the insights that matter

Legal

  • Terms and conditions
  • Privacy policy

More

  • Pricing
  • Advertise
  • onedump
  • gosnakego
  • Contact us

Social

  • X (Twitter)
  • GitHub
Trendshift owl
What they build speaks louder than words
© 2026 Trendshift, created by Julian Li with ❤️
SignalAdvertise
Trendshift
SignalAdvertise
Sign in
Trendshift owl

Discover trends that matter

SignalAdvertise
DailyWeeklyMonthlyYearly
Live mentionsTopics
RepositoriesDevelopers
InsightsStats
Bifrost
Bifrost

Boreas37/CVE-2026-64638-PoC-XSS2Shell-

XSS2Shell (CVE-2026-64638) WordPress pre-auth XSS to RCE chain — PoC exploit + defensive audit tool + nuclei template

Visit GitHub
Python
130
32
1 contributors
FeaturedAdvertise to 180K+ monthly visitors
Bifrost

Fastest Enterprise AI Gateway for Routing, Governing, and Securing all your AI Traffic

Momentum

How fast Boreas37/CVE-2026-64638-PoC-XSS2Shell- is gaining stars, and where it lands on Trendshift and GitHub Trending

Activity and trending

Stars, forks and merged pull requests each day or month, lined up with the repository's rank on Trendshift Trending

Sep 9 – Nov 5, 2026

Stars +78 in 58 days

0102030
27

Forks +20 in 58 days

0510
9

Merged PRs 0 in 58 days

01

Trendshift Trendingwhere the repository ranked each day it made the top 25

Not in the Trendshift top 25 in this period

Sep 9Sep 17Sep 25Oct 3Oct 11Oct 19Oct 27Nov 4
The left and right arrow keys step from day to day; Home and End go to the first and the last

Stars, forks, merged pull requests and Trendshift Trending rank, by day
DayStars gainedForks gainedMerged PRs
Wed, Sep 9, 2026+2+00
Thu, Sep 10, 2026+0+00
Fri, Sep 11, 2026+0+00
Sat, Sep 12, 2026+0+00
Sun, Sep 13, 2026+0+00
Mon, Sep 14, 2026+0+00
Tue, Sep 15, 2026+0+00
Wed, Sep 16, 2026+0+00
Thu, Sep 17, 2026+0+00
Fri, Sep 18, 2026+0+00
Sat, Sep 19, 2026+0+00
Sun, Sep 20, 2026+0+00
Mon, Sep 21, 2026+0+10
Tue, Sep 22, 2026+0+00
Wed, Sep 23, 2026+0+00
Thu, Sep 24, 2026+0+00
Fri, Sep 25, 2026+1+00
Sat, Sep 26, 2026+0+00
Sun, Sep 27, 2026+0+00
Mon, Sep 28, 2026+0+00
Tue, Sep 29, 2026+0+00
Wed, Sep 30, 2026+1+00
Thu, Oct 1, 2026+0+00
Fri, Oct 2, 2026+0+00
Sat, Oct 3, 2026+0+00
Sun, Oct 4, 2026+0+00
Mon, Oct 5, 2026+0+00
Tue, Oct 6, 2026+0+00
Wed, Oct 7, 2026+0+00
Thu, Oct 8, 2026+0+00
Fri, Oct 9, 2026+0+00
Sat, Oct 10, 2026+0+00
Sun, Oct 11, 2026+0+00
Mon, Oct 12, 2026+0+00
Tue, Oct 13, 2026+1+00
Wed, Oct 14, 2026+0+00
Thu, Oct 15, 2026+0+00
Fri, Oct 16, 2026+0+00
Sat, Oct 17, 2026+0+00
Sun, Oct 18, 2026+0+00
Mon, Oct 19, 2026+0+00
Tue, Oct 20, 2026+0+00
Wed, Oct 21, 2026+0+00
Thu, Oct 22, 2026+18+40
Fri, Oct 23, 2026+27+90
Sat, Oct 24, 2026+11+50
Sun, Oct 25, 2026+5+10
Mon, Oct 26, 2026+3+00
Tue, Oct 27, 2026+2+00
Wed, Oct 28, 2026+1+00
Thu, Oct 29, 2026+1+00
Fri, Oct 30, 2026+2+00
Sat, Oct 31, 2026+2+00
Sun, Nov 1, 2026+0+00
Mon, Nov 2, 2026+1+00
Tue, Nov 3, 2026+0+00
Wed, Nov 4, 2026+0+00
Thu, Nov 5, 2026+0+00
Total+78+200
  • 1#1 on the list
  • 7Rank that day
  • Not trending

Social mentions

Recent discussions about this repository across the web
  1. Aug 141 post

    • 💀 CVE-2026-64638: XSS2Shell (WP login XSS to RCE)WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Detection: Join team 👉

      Read full on X, posted by @luckyhacker43

      @luckyhacker43 · x.com

You might also like

Repositories close to Boreas37/CVE-2026-64638-PoC-XSS2Shell-
FeaturedAdvertise to 180K+ monthly visitors
Bifrost

Fastest Enterprise AI Gateway for Routing, Governing, and Securing all your AI Traffic

Icex0/wp2shell-poc

Python

wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain

812201

sergiointel/wp2shell-poc

Python

Stock vulnerable wordpress RCE poc for wp2shell.

11427

DeathShotXD/Comment2Shell

Python

Comment2Shell is a zero click pre auth RCE exploit for WordPress CVE-2026-93485. An anonymous comment plants stored XSS that fires when an admin views the post and drops a self deleting webshell. Full chain PoC with scanner interactive shell Nuclei template and Docker

6517

0xsha/wp2shell

Python

CVE-2026-63030 + CVE-2026-60137 - “wp2shell”: unauthenticated RCE in WordPress core

12139

ZephrFish/wp2shell-scanner

Python

CVE-2026-63030, CVE-2026-60137, wp2shell scanner

7116

Chocapikk/CVE-2023-6553

Python

Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution

8824

AiGptCode/AiGPT-WordPress-Exploitation-Framework

Python

AiGPT started from the concept of CVE‑2024‑27956 , the WP Automatic CSV injection — but has been completely rebuilt into a multi‑vector, unauthenticated WordPress exploitation engine. It now chains 13 real‑world CVEs to create an administrator account or drop a web shell directly, then automatically injects a reverse shell into the active theme

13434

aarsaputra/php2shell

Python

Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design

13362

Chocapikk/CVE-2024-25600

Python

Unauthenticated Remote Code Execution – Bricks <= 1.9.6

18339