What is the CVSS score of CVE-2026-57769?

CVE-2026-57769 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Grand Photography are affected by CVE-2026-57769?

WordPress sites using ThemeGoods 'Grand Photography' theme (version 5.7.8 or earlier) are vulnerable to remote, unauthenticated cross-site scripting attacks that compromise visitor accounts and…

How to fix or mitigate CVE-2026-57769?

Within 24 hours, inventory all WordPress installations to identify deployments of Grand Photography theme version 5.7.8 or earlier and assess business criticality. Within 7 days, update to a patched version if available from the vendor, or replace the theme entirely with a WordPress.org-recommended secure alternative; immediately disable the vulnerable theme on production if no upgrade exists. Within 30 days, audit affected sites for prior exploitation indicators, implement Content Security Policy headers restricting inline script execution, and establish automated theme security monitoring.

Grand Photography CVE-2026-57769

EUVD-2026-48180 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-w67x-xfqq-cj4r

XSS Grand Photography WordPress Wordpress Theme

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated network-reachable reflected XSS needing victim click (UI:R); scope changes into the browser session (S:C) with low confidentiality/integrity impact and no availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:22 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions.

AnalysisAI

Reflected Cross-Site Scripting in the ThemeGoods 'Grand Photography' WordPress theme (versions 5.7.8 and earlier) lets remote unauthenticated attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 score is 7.1 (scope-changed) and the flaw was disclosed by Patchstack under CWE-79. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Technical ContextAI

Grand Photography is a commercial WordPress theme built by ThemeGoods (CPE cpe:2.3:a:themegoods:grand_photography), sold for portfolio and photography sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the theme reflects attacker-controlled request input (typically a URL parameter) back into an HTML response without proper output encoding or input sanitization. Because WordPress themes render server-side PHP templates, an unescaped echo of $_GET/$_REQUEST data into markup allows a script payload to be parsed and executed by the victim's browser in the context of the vulnerable site's origin.

RemediationAI

No vendor-released patch version is identified in the available data; the input only confirms that versions <= 5.7.8 are vulnerable, so administrators should check the Patchstack advisory (https://patchstack.com/database/wordpress/theme/grandphotography/vulnerability/wordpress-grand-photography-theme-5-7-8-reflected-cross-site-scripting-xss-vulnerability) and the ThemeGoods vendor page for an update newer than 5.7.8 and upgrade to it once released. Until a fixed version is confirmed, compensating controls include deploying a WordPress-aware WAF or virtual patch (Patchstack offers one) to filter script-injection payloads on the theme's request parameters, and adding a restrictive Content-Security-Policy header to block inline/external script execution - noting CSP may break legitimate theme JavaScript and requires testing. Restricting or monitoring the specific vulnerable endpoint/parameter reduces exposure but does not fully eliminate the reflected injection.