What is the CVSS score of CVE-2026-57325?

CVE-2026-57325 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Wordpress Theme are affected by CVE-2026-57325?

The NanoMag WordPress theme (versions 1.8 and earlier) contains an unauthenticated cross-site scripting (XSS) vulnerability allowing attackers to inject scripts into user sessions; no public exploit…

How to fix or mitigate CVE-2026-57325?

Within 24 hours: Audit all WordPress instances for NanoMag theme installation (versions ≤1.8); deactivate vulnerable theme and switch to maintained alternative. Within 7 days: Review user session logs for exploitation indicators; deploy Web Application Firewall (WAF) rules to block XSS payloads targeting WordPress installations. Within 30 days: Monitor vendor advisories for NanoMag patch release; plan migration to patched version upon availability; conduct full security assessment of affected WordPress sites.

Wordpress Theme CVE-2026-57325

EUVD-2026-39737 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 audit@patchstack.com

GHSA-qg4w-7qrf-47gf

WordPress XSS Wordpress Theme

7.1

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from Vendor (patchstack) · only source for this CVE.

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:52 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions.

AnalysisAI

Cross-Site Scripting in the NanoMag WordPress theme (versions 1.8 and earlier) lets unauthenticated remote attackers inject browser-executed script that runs in the context of a victim lured into following a crafted link or loading an attacker-influenced page. The CVSS 3.1 score is 7.1 with a scope change, reflecting that script executes beyond the vulnerable component into the user's session. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.