EUVD-2026-58084
GHSA-7j49-7w6m-5r8m
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-reachable reflected XSS with no attacker authentication and a browser-scope change; availability set to N since reflected XSS does not disrupt service availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS.
This issue affects Samex - Clean, Minimal Shop WooCommerce WordPress Theme: from n/a through 2.5; M.Anh - Fashion WooCoommerce WordPress Theme: from n/a through 1.7.
AnalysisAI
Reflected cross-site scripting in two snstheme WooCommerce WordPress themes - Samex (through version 2.5) and M.Anh (through version 1.7) - permits unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a specially crafted URL that the theme reflects back unsanitized into the HTML response. The scope change (S:C) in the CVSS vector indicates that successful exploitation extends impact beyond the WordPress application into the victim's browser origin, enabling session hijacking or administrative account compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target WordPress installation has either the Samex theme at version 2.5 or earlier, or the M.Anh theme at version 1.7 or earlier, set as the active theme, and that the WooCommerce plugin is installed and active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.1 reflects a network-reachable, low-complexity reflected XSS with no privilege requirement on the attacker side (PR:N), but the mandatory victim interaction (UI:R) meaningfully caps real-world exploitability relative to a stored or DOM-based variant. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to update each affected theme to a version released after the stated vulnerability ceiling - Samex beyond version 2.5 and M.Anh beyond version 1.7 - if patched releases have been issued by snstheme. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your WordPress environment to identify any active deployments of Samex (version 2.5 or earlier) or M.Anh (version 1.7 or earlier) and assess their public-facing exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today