TechOne WordPress Theme CVE-2026-62093

Exploitation requires the TechOne WordPress theme at version 3.0.3 or earlier to be installed and active, and requires a victim to interact by clicking or loading an attacker-crafted URL (UI:R) that carries the XSS payload into a reflected, unsanitized input. No authentication is needed by the attacker (PR:N), but the mandatory user-interaction step is the key limiting factor: the payload does not persist and only fires for users tricked into following the malicious link, so exploitation cannot occur autonomously against the server. Impact is confined to the victim's browser session in the site's context.

This is a reflected Cross-Site Scripting flaw (CWE-79) in the TechOne WordPress theme (vendor kutethemes) in versions <= 3.0.3, reported by Patchstack with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The vector shows network reachability, low complexity, and no required privileges (PR:N = unauthenticated), but it depends on user interaction (UI:R) - the victim must be lured into following a crafted link, which is the primary factor keeping real-world risk below the raw score. The elevated 7.1 is driven largely by the scope change (S:C), typical of XSS where injected script executes in the victim's browser outside the vulnerable component's security authority. No EPSS score, no CISA KEV listing, and no public exploit were provided in the intelligence; there is no public exploit identified at time of analysis, so there is no evidence of active exploitation. Net assessment: a genuine but interaction-dependent web vulnerability in a niche WordPress theme - worth patching, but not a mass-exploitation emergency. Note a signal gap: EPSS/KEV/POC data were simply absent from the input rather than confirmed negative, so exploitation likelihood could not be quantified.

An attacker crafts a malicious URL targeting a vulnerable input in a TechOne theme (<= 3.0.3) that reflects unsanitized parameter data into the page. They send this link to a site visitor or administrator; when the victim opens it, attacker-controlled JavaScript executes in the victim's browser session in the context of the WordPress site. No public proof-of-concept was referenced in the available data.