XSS2Shell is a pre-authentication XSS to code-execution chain affecting WordPress Core (all versions back to 4.7, ~500M+ sites). A single crafted failed-login attempt runs attacker JavaScript in the WordPress origin; against a logged-in administrator it escalates to full RCE

🐥 A victim already logged in as a single-site Administrator
🐥 Explicit interaction (typically one click) with an attacker-controlled page
🐥 Specific WordPress features aligned (Application Passwords, plugin upload capability, etc.)