WordPress Login Screen - Pre-Auth Reflected XSS

Could your systems be exposed to this vulnerability?

WordPress login screen (wp-login.php) is vulnerable to pre-authentication reflected cross-site scripting (XSS). A specially crafted URL causes arbitrary JavaScript execution in a victim's browser context. Under conditions outside the attacker's control, this may be escalated to remote code execution via social engineering. All WordPress versions prior to 7.0.3 are affected; the fix has been backported to all branches back to 4.7. The advisory does not disclose the exact vulnerable parameter; this template probes common wp-login.php query parameters for unescaped HTML reflection as a best-effort black-box detection method.

Enter a domain or public IP you own. We'll check for signs of exposure. No signup required.