EUVD-2026-23172
GHSA-742g-5jmq-x7cr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Vantage theme for WordPress is vulnerable to Stored Cross-Site Scripting via Gallery block text content in versions up to, and including, 1.20.32 due to insufficient output escaping in the gallery template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting in the Vantage WordPress theme up to version 1.20.32 allows authenticated contributors and higher-privileged users to inject malicious scripts into gallery block text content that execute for all site visitors. The vulnerability stems from insufficient output escaping in the gallery template, enabling attackers with contributor-level access to compromise page integrity and potentially steal session tokens or deface content.
Technical ContextAI
The Vantage theme (CPE: cpe:2.3:a:siteorigin:vantage:*:*:*:*:*:*:*:*) processes user-supplied text in WordPress gallery blocks through a custom gallery template without proper HTML entity encoding or sanitization on output. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a stored variant where malicious input persists in the WordPress database and executes in the context of other users' browsers. WordPress contributors can create or edit pages containing gallery blocks, making this a privilege-escalation concern within multi-author WordPress installations. The theme's gallery template fails to apply WordPress escaping functions (such as esc_html, esc_attr, or wp_kses_post) when rendering gallery text content to the frontend, allowing arbitrary HTML and JavaScript to be injected.
RemediationAI
Update the Vantage theme to version 1.20.33 or later, which includes proper output escaping in the gallery template (confirmed by WordPress.org themes changeset 320834). In WordPress admin, navigate to Appearance → Themes, locate Vantage, and click Update if available; alternatively, download the patched version from wordpress.org/themes/vantage. Until patching is feasible, restrict contributor-level access to users who are trusted and internally managed - use WordPress role management to revoke publish_pages capability from untrusted contributors and limit gallery block usage to administrators only via plugins like Gutenberg Pro or custom post capabilities filters. Audit existing pages for suspicious gallery content by searching the WordPress database for unusual HTML patterns in post meta, and review page revision history in WordPress admin for unexpected changes. Note that restricting contributor access may impact editorial workflow but provides strong protection; database audits require technical expertise or use of security plugins like Wordfence or Sucuri.
A privilege escalation vulnerability was reported in LenovoBatteryGaugePackage for Lenovo System Interface Foundation bu
Privilege escalation via symlink following in Lenovo Vantage and Lenovo Commercial Vantage allows a local authenticated
Arbitrary file deletion with elevated privileges is possible in the VantageCoreAddin component of Lenovo Vantage and Len
Arbitrary file write with elevated privileges exists in Lenovo Diagnostics and HardwareScanAddin components of Lenovo Va
A vulnerability was reported in Lenovo Vantage prior to version 10.2003.10.0 that could allow an authenticated user to r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today