EUVD-2026-70980
GHSA-j325-4h26-xg44
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
DOM-XSS executes client-side with S:C scope change; PR:L requires a low-privilege account; A:N as XSS does not cause availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
3DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xtemos WoodMart allows DOM-Based XSS.
This issue affects WoodMart: from n/a before 8.3.8.
AnalysisAI
DOM-Based XSS in the WoodMart WordPress theme (all versions before 8.3.8) allows low-privilege authenticated attackers to inject malicious scripts into the browsers of higher-privileged users visiting affected pages. The CVSS scope change (S:C) indicates the injected payload can reach beyond WoodMart's own security boundary into the broader WordPress page context, enabling session theft or privilege escalation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid low-privilege authenticated account on the target WordPress site (CVSS PR:L) - any role such as WooCommerce customer, subscriber, or shop manager satisfies this. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) positions this as a medium-severity, network-reachable vulnerability requiring a low-privilege account and victim interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update WoodMart to version 8.3.8 or later via the WordPress theme updater or by downloading directly from Xtemos; this release resolves the DOM-Based XSS as documented in the Patchstack advisory (https://patchstack.com/database/wordpress/theme/woodmart/vulnerability/wordpress-woodmart-theme-8-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Deserialization of Untrusted Data vulnerability in xtemos WoodMart - Multipurpose WooCommerce Theme.0.36. Rated critical
The WoodMart plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.2.3 via
A PHP object injection vulnerability exists in the xtemos WoodMart WordPress theme through version 8.3.8, stemming from
The The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including
The Woodmart theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'multiple_markers' attrib
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
A vulnerability in xtemos WoodMart woodmart.1.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploi
WoodMart versions 8.3.9 and earlier expose sensitive embedded system information to unauthorized parties through imprope
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today