EUVD-2026-41330
GHSA-49cj-8cwx-rw82
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated reflected XSS (PR:N) needing victim click (UI:R) with browser-context scope change (S:C); low C/I but no genuine availability impact, so A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in NativeChurch <= 4.8.8.2 versions.
AnalysisAI
Reflected cross-site scripting in the NativeChurch WordPress theme (versions 4.8.8.2 and earlier, by imithemes) allows unauthenticated attackers to inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 vector (7.1) reflects a scope change with limited confidentiality, integrity, and availability impact, and requires victim interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a site running the NativeChurch theme at version 4.8.8.2 or earlier, and - per CVSS UI:R - the attacker must convince a victim to click or load a specially crafted URL containing the XSS payload; it cannot be triggered unattended against the server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1 High) indicates network-reachable, low-complexity, unauthenticated exploitation, but crucially requires user interaction (UI:R) - the victim must click or load a malicious link, which meaningfully limits mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a URL to the target NativeChurch-powered site with a malicious script payload embedded in a reflected parameter and delivers it to a logged-in administrator via email or a forum post. When the victim opens the link, the injected JavaScript executes in their authenticated browser session, allowing the attacker to steal session cookies, perform actions as the admin, or redirect the user. … |
| Remediation | Upgrade the NativeChurch theme to a release newer than 4.8.8.2 once imithemes publishes a fixed version; the input data does not specify an exact patched version, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/nativechurch/vulnerability/wordpress-nativechurch-theme-4-8-8-2-reflected-cross-site-scripting-xss-vulnerability) and the imithemes vendor page to confirm the target version before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory WordPress instances running NativeChurch theme versions 4.8.8.2 or earlier and document user-facing sites. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today