What is the CVSS score of CVE-2026-57397?

CVE-2026-57397 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Coaching Theme are affected by CVE-2026-57397?

The ThimPress Coaching WordPress theme (versions 3.9.2 and earlier) contains a cross-site scripting vulnerability allowing unauthenticated remote attackers to inject malicious code that executes when…

How to fix or mitigate CVE-2026-57397?

Within 24 hours, scan all WordPress deployments to identify instances running ThimPress Coaching theme and document specific versions in use. Within 7 days, either disable the theme entirely, migrate to an alternative maintained WordPress theme, or deploy Web Application Firewall rules to block XSS payloads in user input combined with strict Content Security Policy headers. Within 30 days, conduct forensic review of user authentication logs and session activity for signs of account compromise, replace the theme with a security-maintained alternative if not already completed, and establish quarterly security audits of WordPress themes and plugins.

Coaching Theme CVE-2026-57397

EUVD-2026-48167 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-5rh3-g2c9-6q79

WordPress XSS Coaching Wordpress Theme Thimpress

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable unauthenticated reflected XSS requiring victim interaction (UI:R); injected script runs cross-context (S:C) with limited browser-side confidentiality/integrity/availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:18 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions.

AnalysisAI

Cross-site scripting in the ThimPress "Coaching" WordPress theme (versions <= 3.9.2) lets remote unauthenticated attackers inject arbitrary script that executes in a victim's browser after they interact with a crafted link or page. Reported by Patchstack under CWE-79, the flaw carries a CVSS 3.1 score of 7.1 with a scope change, but there is no public exploit identified at time of analysis and no active-exploitation (KEV) or EPSS signal in the provided data. Impact is primarily session/account compromise of users who view attacker-controlled content within a site running the theme.

Technical ContextAI

The affected component is the Coaching WordPress theme published by ThimPress (CPE cpe:2.3:a:thimpress.:coaching:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input is reflected or stored into HTML output without adequate sanitization or output encoding, allowing an attacker to break out of the intended data context and inject executable JavaScript. WordPress themes commonly introduce such flaws through custom template files, shortcodes, search/query parameters, or form handlers that echo request data directly. Because CVSS marks the vulnerability as unauthenticated (PR:N), the injection surface is reachable without a logged-in session, consistent with a reflected or DOM-based XSS delivered through a URL parameter or public-facing input.

RemediationAI

Update the Coaching theme to the vendor-released fixed version once confirmed; the input does not specify an exact patched release, so No vendor-released patch version is independently confirmed at time of analysis - verify the fixed version via the Patchstack advisory (https://patchstack.com/database/wordpress/theme/coaching/vulnerability/wordpress-coaching-theme-3-9-2-cross-site-scripting-xss-vulnerability) and the ThimPress vendor page before upgrading. Until a confirmed patch is applied, deploy a WAF or virtual patch (Patchstack and similar offer specific XSS rules for this theme) to filter script-injection payloads on the affected endpoints, and restrict or sanitize the request parameters the theme reflects; note WAF rules can be bypassed and may cause false positives on legitimate rich content. As a stronger interim control, add a restrictive Content-Security-Policy that disallows inline script to blunt injected payloads (trade-off: may break theme features relying on inline JS), and consider disabling the theme on high-value sites until the update is available.