Miti CVE-2026-25350

Remote unauthenticated attacker crafts malicious URL containing XSS payload and sends it to victim. Victim must click the link in skygroup Miti versions prior to 1.5.3. No special configuration required; reflected XSS against default installation.

While a CVSS score and EPSS probability score are not provided for this CVE, the underlying risk is moderate to high based on available signals. Reflected XSS vulnerabilities typically have a CVSS vector of AV:N/AC:L/PR:N/UI:R (Network vector, Low complexity, No privileges required, User Interaction required), suggesting broad attack surface and low barrier to exploitation. The reflected nature of the XSS means an attacker must trick a user into clicking a malicious link, which adds a social engineering component but does not significantly reduce real-world exploitability—phishing and link injection are well-established attack techniques. The lack of KEV status and EPSS data suggests this may be a lower-priority vulnerability in terms of widespread active exploitation, but the existence of a documented patch in version 1.5.3 and reporting via Patchstack (a reputable security intelligence platform) indicates this was a genuine finding that required remediation. Given that WordPress themes are widely deployed and many administrators delay updates, this vulnerability likely poses a meaningful risk to unpatched Miti installations.

An attacker crafts a malicious URL containing JavaScript payload in a query parameter (e.g., https://victim-site.com/?search=<script>alert('XSS')</script>) and sends it to a website administrator or user via email or social media. When the victim clicks the link and the unpatched Miti theme renders the search parameter without proper output encoding, the injected JavaScript executes in the victim's browser within the context of the website domain, allowing the attacker to steal session cookies, capture form data, or redirect the user to a phishing site. No public proof-of-concept code is referenced in available sources, but the straightforward nature of reflected XSS vulnerabilities means exploitation requires minimal technical sophistication.