Graphene WordPress Theme CVE-2026-17025

Exploitation requires an authenticated account with Subscriber-level access or above (PR:L) that can edit the Graphene-specific 'Current location' and 'Author profile image URL' profile fields; the injected payload is stored and fires when any user - typically an admin or visitor - loads a page rendering that profile/author data, so no interaction from the attacker is needed at trigger time (UI:N). Key limiting factors: the site must run the Graphene theme at version 2.9.4 or earlier, and the attacker must obtain at least Subscriber privileges - a low bar on sites with open registration but a hard stop on sites that disable self-registration or restrict account creation.

This is a moderate-risk, authenticated stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) that realistically sits well below top-priority despite its network attack vector. The CVSS vector confirms low attack complexity and no user interaction to trigger the payload once stored, but PR:L means an attacker must first hold a valid account at Subscriber level or higher - a meaningful barrier on sites that do not allow open or untrusted registration. The scope change (S:C) and limited confidentiality/integrity impact (C:L/I:L) are consistent with classic WordPress stored XSS that executes in other users' browser sessions rather than compromising the server directly. There is no CISA KEV listing and no public exploit was supplied in the intelligence, so this is 'no public exploit identified at time of analysis' - do not treat it as actively exploited. No EPSS score was provided, so exploitation-probability data is MISSING and cannot be weighed here. The signals are internally consistent (network-reachable but privilege-gated, low impact), so there is no contradiction to flag; the practical priority is elevated mainly on sites that permit self-registration, where a low-privilege Subscriber can reach the vulnerable profile fields.

On a Graphene-themed WordPress site that allows self-registration, an attacker registers a Subscriber account and injects a malicious script into the 'Current location' or 'Author profile image URL' profile fields, which are stored without sufficient sanitization or output escaping. When an administrator or other visitor views a page rendering that profile data (e.g., the author loop), the script executes in their browser, enabling session/cookie theft or admin-context actions. No public exploit code was identified in the provided intelligence.