xss 1 XSS2Shell: How a WordPress Login Page XSS Chains Its Way to Remote Code Execution (CVE-2026-64638) Aug 12, 2026