WordPress 7.0.3 patches pre-auth login XSS to RCE (CVE-2026-64638, XSS2Shell)

WordPress 7.0.3 (Aug 6, 2026) closes CVE-2026-64638 / XSS2Shell (CVSS 8.9): a whitespace tag like `< area` slips past strip_tags but KSES restores it, giving pre-auth login XSS that chains to PHP RCE. All versions affected; fix backported to 4.7.