WordPress has released security updates for CVE-2026-64638, a high-severity vulnerability affecting the login page that has been patched in WordPress 7.0.3 and backported to supported branches. The bug itself is a pre-authentication reflected XSS caused by a parser differential between WordPress's input handling and HTML sanitization pipeline. According to the published research, malformed input survives strip_tags() but is later interpreted as valid HTML by wp_kses_post(), allowing attacker-controlled DOM elements to be injected into the failed login page.