Jannah WordPress Theme CVE-2026-42693

Exploitation requires the attacker to get a victim to interact with attacker-controlled input on a site running the Jannah theme version 7.6.5 or earlier (CVSS UI:R), typically by clicking a crafted link or visiting a page carrying the injected payload. No authentication is required of the attacker (PR:N), but the limiting factors are the mandatory victim interaction and the client-side-only impact - code runs in the victim's browser within the site origin, not on the server. The exact vulnerable parameter/feature is not named in the description beyond it being an unauthenticated XSS in the Jannah theme; impact scales with whether victims are logged-in administrators versus anonymous visitors.

This is a reflected/stored unauthenticated Cross-Site Scripting flaw (CWE-79) in the Jannah WordPress theme at or below version 7.6.5. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) signals a network-reachable, low-complexity issue requiring no attacker privileges but DOES require victim user interaction (UI:R), with a changed scope reflecting the browser-context crossover typical of XSS. No EPSS probability, CISA KEV entry, or public POC is present in the supplied data, so despite the HIGH-ish 7.1 score the demonstrated real-world exploitation signal is currently absent - this reads as a legitimate but not emergency-priority web vulnerability rather than a mass-exploited threat. The single source is Patchstack (a reputable WordPress vulnerability curator), but no independent EPSS/KEV corroboration is available; the UI:R requirement and client-side-only impact (C:L/I:L/A:L, all Low) meaningfully cap severity because an attacker must lure an authenticated or anonymous victim into triggering the payload rather than achieving direct server compromise. Priority should be driven by deployment exposure: patch promptly on internet-facing sites, but this is not a drop-everything issue absent exploitation evidence.

An attacker crafts a malicious URL or input targeting a vulnerable parameter in the Jannah theme and delivers it to a victim (e.g., via phishing or a planted link), where UI:R means the victim must open the link or interact with the affected page. When rendered, the injected script executes in the victim's browser session in the site's origin, enabling session-token theft, forced actions, or redirection. No public exploit code is identified at time of analysis.