EUVD-2025-210404
GHSA-jjcv-hgrx-x8hh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft URL with malicious script payload
-
DeliveryDeliver crafted link to victim via phishing
-
ExploitVictim loads vulnerable Artale theme page
-
ExecutionInjected script executes in victim browser
-
ImpactSteal session tokens or hijack actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target WordPress site to be running the Artale Wedding Photography theme at version 2.2.2 or earlier, and requires victim interaction (CVSS UI:R) - a user must click an attacker-crafted link or load a page carrying the injected payload. No authentication is needed (PR:N) and the request path is network-reachable (AV:N) with low complexity (AC:L), so the attacker does not need site credentials. The principal limiting factors are the mandatory user interaction, the narrow requirement that this specific theme be installed and active, and the low per-impact severity (C:L/I:L/A:L) confining damage to the victim's browser context rather than the server. |
| Impact | The signals point to a moderate, opportunistic risk rather than a top-tier emergency. The CVSS 3.1 base of 7.1 is elevated mainly by the scope change (S:C) and the unauthenticated network vector (AV:N/AC:L/PR:N), but the impacts are only Low across confidentiality, integrity, and availability and the attack requires user interaction (UI:R) - a victim must click a crafted link or visit a malicious page. No EPSS score, SSVC decision, or POC was supplied, and the vulnerability is not in CISA KEV, so there is no evidence of active or automated exploitation. XSS in a niche photography theme is realistically a targeted phishing/defacement/session-theft tool, not a mass-exploited RCE; treat it as a standard patch-cycle item unless the theme is exposed on a high-value or high-traffic WordPress site. |
| Exploit ScenarioDerived | An attacker crafts a URL to a vulnerable Artale theme endpoint containing a malicious script payload and delivers it to a site visitor or logged-in administrator via phishing or a comment/link. When the victim opens the link, the unsanitized input reflects into the page and the script runs in their browser session, letting the attacker steal cookies/session tokens, perform actions as the victim, or redirect them to malicious content. No public POC has been identified, and success depends on the victim's interaction (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 02, 2026
Reflected/stored Cross-Site Scripting in the Artale Wedding Photography WordPress theme (versions 2.2.2 and earlier) lets unauthenticated remote attackers inject arbitrary JavaScript that executes in a victim's browser after they follow a crafted link or load a poisoned page. Reported by Patchstack and rated CVSS 7.1 with a scope change, it primarily threatens site visitors and administrators through session/context theft rather than direct server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Upgrade the Artale theme to a fixed release above 2.2.2 once the vendor (ThemeGoods) publishes one; the Patchstack advisory (https://patchstack.com/database/wordpress/theme/artale/vulnerability/wordpress-artale-wedding-photography-wordpress-theme-2-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve) is the authoritative source for the patched version, which is not stated in the available data. If no fixed version is yet available, apply virtual patching via a WAF or Patchstack's protection module to filter script payloads on the vulnerable request path, and add a restrictive Content-Security-Policy to block inline/injected script execution (side effect: may break legitimate inline scripts and require tuning). As a stronger interim control, restrict or disable the affected front-end feature or switch to an alternate theme on exposed production sites, accepting the loss of that theme's functionality until a patched build is confirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Artale, a commercial WordPress theme by ThemeGoods marketed for wedding photography sites (CPE cpe:2.3:a:themegoods:artale_|_wedding_photography_wordpress:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input is reflected into HTML output without proper output encoding or input sanitization. Because the CVSS vector marks it unauthenticated (PR:N), the injectable sink is reachable via a public request path (e.g., a theme parameter, search/form field, or front-end template) rather than an authenticated admin screen, allowing attacker-supplied markup/script to be rendered in the page.
Know when Artale Wedding Photography Wordpress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated reflected XSS reachable over the network (PR:N/AV:N) but requiring a victim to click (UI:R), with a scope change into the browser and only low C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Artale | Wedding Photography WordPress <= 2.2.2 versions.
Executive ViewAI
The Artale Wedding Photography WordPress theme (versions 2.2.2 and earlier) contains a vulnerability that allows attackers to inject malicious code into web pages without requiring authentication. Site visitors and administrators who access compromised pages execute this code in their browsers, enabling credential theft, account hijacking, and data exfiltration. Organizations using this theme face immediate risk to customer data, administrative accounts, and website integrity.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately disable the Artale theme and replace with an alternative; (2) Implement Web Application Firewall rules to block reflected/stored XSS payloads targeting the theme; (3) Deploy Content Security Policy headers to restrict inline script execution; (4) Enable security plugin restrictions on the theme's vulnerable functions; (5) Monitor all administrator accounts for unauthorized access; (6) Conduct code audit of any custom theme modifications for similar vulnerabilities.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB