Jaroti CVE-2026-25304

The victim must click a malicious link containing XSS payload targeting Jaroti versions before 1.4.8. Remote unauthenticated attacker crafts the URL; no special product configuration required. User interaction essential.

Although no CVSS score, CVSS vector, or EPSS score is available for this vulnerability, the underlying risk profile is moderate to moderately-high. Reflected XSS attacks (CWE-79) typically have a network attack vector and low attack complexity, making them relatively easy to exploit compared to other vulnerability classes. The primary limiting factor is that reflected XSS requires user interaction—an attacker must trick a victim into clicking a malicious link—which reduces the autonomous exploitation potential compared to stored XSS. The fact that a patch (version 1.4.8) is available and the vulnerability was reported via Patchstack (a reputable WordPress security database) indicates vendor awareness and timely remediation. Without confirmation of active exploitation (KEV status), public POC availability, or widespread deployment metrics, this should be treated as a standard-priority patch based on attack vector (network-accessible theme functionality) and the broad user base of WordPress themes. Organizations should prioritize patching to prevent reflected XSS attacks that could compromise user sessions or data.

An attacker crafts a malicious URL containing JavaScript code embedded in a URL parameter expected by the Jaroti theme (e.g., a search query or custom parameter field) and sends it to target users via phishing email, social media, or forum posts. When a victim clicks the link, the Jaroti theme reflects the unsanitized input back into the page HTML, causing the attacker's JavaScript to execute in the victim's browser with full access to session cookies, local storage, and page content. The attacker could then harvest session tokens, redirect the user to a credential-harvesting page, or perform unauthorized actions (such as changing account settings or publishing posts) if the victim is authenticated to the WordPress site. Exploitation requires no special privileges or technical complexity beyond URL crafting and social engineering, making this a practical attack vector against WordPress installations running the vulnerable Jaroti theme.