Pre-auth reflected XSS in WordPress login failed-login error page affects all versions; crafted username survives sanitize_user()/wp_strip_all_tags() then is re-parsed by wp_kses_post() into live DOM. Injected DOM clobbers ajaxurl and abuses user-profile.js + REST JSONP (_envelope=1) for same-origin JS; admin click can lead to PHP code execution (e.g., plugin/ZIP upload). Patch to 7.0.3 (Aug 6) or backported >=4.7 security releases.