Coaching Theme CVE-2026-57397

Exploitation requires no authentication (PR:N) but does require user interaction (UI:R): a victim must load an attacker-crafted URL or view attacker-supplied content on a WordPress site running the ThimPress Coaching theme at version 3.9.2 or earlier. The specific injectable parameter or template is not detailed in the available data. Limiting factors: the victim must be induced to click/interact, the target site must have the vulnerable theme active, and full impact (e.g., admin takeover) depends on targeting a privileged user's session rather than an anonymous visitor.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1 High) indicates network-reachable, low-complexity, unauthenticated exploitation that nevertheless requires user interaction (UI:R) - a victim must click a link or load malicious content - which materially lowers real-world weaponizability compared to a no-interaction flaw. The scope change (S:C) reflects that injected script runs in the victim's browser context, potentially affecting authenticated admins if targeted. No EPSS score, KEV listing, or SSVC decision data was supplied, so probabilistic and automatable-exploitation signals cannot be evaluated; there is no public exploit identified at time of analysis. Overall this is a genuine but moderate-priority issue: typical of the large volume of WordPress theme XSS advisories, dangerous mainly in targeted phishing/admin-takeover scenarios rather than mass automated exploitation. The low deployment footprint of this specific theme further reduces aggregate risk.

An attacker crafts a URL or submits public input to a Coaching-themed site containing a malicious JavaScript payload, then lures a victim - ideally a logged-in administrator - to click it via phishing or a comment/referrer. When the victim's browser renders the unsanitized output, the script executes in the site's origin, enabling session cookie theft, CSRF-token abuse, or actions performed as the victim. No public proof-of-concept is identified in the available data, and successful attack depends on the required user interaction (UI:R).