What is the CVSS score of CVE-2026-56072?

CVE-2026-56072 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of WoodMart are affected by CVE-2026-56072?

WoodMart theme versions up to 8.5.3 used in WordPress and WooCommerce deployments contain a reflected cross-site scripting vulnerability that allows attackers to hijack customer sessions and perform…

How to fix or mitigate CVE-2026-56072?

24 hours: Inventory all WordPress/WooCommerce properties running WoodMart theme versions ≤8.5.3; deploy Web Application Firewall rules blocking reflected XSS payloads targeting theme parameters; enable detailed request logging for security monitoring. 7 days: Implement Content Security Policy headers to prevent inline script execution; prepare and test alternative WooCommerce theme deployments as contingency; contact WoodMart vendor (via Patchstack advisory) requesting patch release timeline and interim updates. 30 days: Apply vendor-released patch immediately upon availability or complete migration to alternative theme; conduct penetration testing of all theme-related inputs; validate PCI-DSS compliance status post-remediation.

WoodMart CVE-2026-56072

EUVD-2026-39724 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 audit@patchstack.com

GHSA-p5jp-3f2p-w428

WordPress XSS Wordpress Theme

7.1

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network-reachable reflected XSS (PR:N, AV:N, AC:L) requires victim click (UI:R); script crosses into the user session (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:55 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions.

AnalysisAI

Reflected cross-site scripting in the WoodMart premium WooCommerce/WordPress theme (versions up to and including 8.5.3) allows unauthenticated remote attackers to inject script that executes in a victim's browser when the victim is lured into triggering a crafted request. The flaw was disclosed via Patchstack and carries a CVSS 3.1 score of 7.1 with a changed scope, reflecting impact that crosses from the theme into the user's authenticated session context. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

WoodMart is a widely sold commercial WordPress theme oriented toward WooCommerce storefronts, exposing numerous front-end templates, AJAX handlers, and shortcode/parameter-driven rendering paths. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input is reflected into HTML output without adequate output encoding or sanitization. Because the CVSS scope is marked Changed (S:C), the injected script runs in the security context of the rendering page/browser session rather than being confined to the vulnerable component, which is characteristic of XSS that can act on a logged-in user's session. No specific affected CPE string was supplied in the input beyond the theme name and the affected version ceiling (<= 8.5.3).

RemediationAI

Upgrade the WoodMart theme to the first release above 8.5.3 that Patchstack/the vendor identifies as fixed; an exact patched version number was not included in the provided input, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/woodmart/vulnerability/wordpress-woodmart-theme-8-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve) and the XTemos changelog to confirm the fixed build before deploying. If immediate updating is not possible, deploy a Web Application Firewall (such as Patchstack's vPatch or an equivalent WAF rule) to filter reflected-XSS payloads against the affected theme endpoints - note this can produce false positives on legitimate input containing markup. As an additional control, ensure a restrictive Content-Security-Policy header is set to limit inline/external script execution, accepting that a strict CSP may break some theme or plugin functionality and require tuning.