What is the CVSS score of CVE-2026-5077?

CVE-2026-5077 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Total WordPress Theme CVE-2026-5077

EUVD-2026-26768 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-02 Wordfence

WordPress XSS

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 10:30 vuln.today

EUVD ID Assigned

May 02, 2026 - 10:00 euvd

EUVD-2026-26768

Analysis Generated

May 02, 2026 - 10:00 vuln.today

CVE Published

May 02, 2026 - 09:26 nvd

MEDIUM 5.4

DescriptionCVE.org

The Total theme for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.2.1 due to insufficient output escaping when rendering the_title() inside HTML attribute context in the home blog section template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the malicious post to be published and displayed with a featured image in the Home Page blog section.

AnalysisAI

Stored Cross-Site Scripting in Total WordPress theme versions up to 2.2.1 allows authenticated contributors and above to inject arbitrary JavaScript via post titles in the home blog section. The vulnerability stems from insufficient output escaping when rendering post titles in HTML attribute context. Exploitation requires the malicious post to be published and displayed with a featured image on the home page, where the injected script will execute in the browsers of all users viewing the page. No public exploit code has been identified, and active exploitation has not been confirmed.

Technical ContextAI

The Total theme for WordPress improperly handles the the_title() WordPress function when rendering post titles within HTML attributes in the home blog section template. The issue is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic Cross-Site Scripting vulnerability. When post titles containing malicious JavaScript are rendered directly into HTML attributes without proper escaping (such as using esc_attr() in WordPress), the JavaScript payload breaks out of the attribute context and executes as active script. The vulnerability is stored, meaning the payload persists in the WordPress database and executes every time the page is loaded, affecting all site visitors who view the injected post.

RemediationAI

The primary remediation is to update the Total theme to version 2.2.2 or later, which implements proper output escaping for post titles in the home blog section template. Site administrators should navigate to the WordPress admin dashboard, go to Appearance → Themes, locate Total, and click Update if available. For immediate protection before updating, site administrators can restrict contributor access to only trusted users, implement post moderation to review all new posts before publication, or temporarily disable the home page blog section feature if not critical to site functionality. The trade-off of restricting contributor access is reduced editorial workflow flexibility; post moderation adds administrative overhead but preserves functionality. Disabling the blog section is the most restrictive but eliminates the attack surface entirely. Reference the Wordfence advisory and WordPress theme repository changeset for patch details and confirmation of the fix.