A critical vulnerability chain in WordPress Core, known as XSS2Shell, enables full remote code execution via a single failed login attempt on any active WordPress installation since version 4.7. This flaw impacts every site powered by the world's most popular content management system, which manages more than 43% of all internet websites. By inserting a space between the opening angle bracket and tag name, such as "< area", it causes PHP's strip_tags function to interpret the string as harmless text while WordPress's KSES sanitizer treats it as legitimate HTML elements.
The parser disagreement allows an attacker to inject live elements like ``, `
`, and `
