Manual WordPress Theme CVE-2026-65511

Exploitation requires user interaction (CVSS UI:R): a victim must be induced to click an attacker-crafted link or load attacker-controlled content that reaches the vulnerable Manual-theme rendering path. No authentication is required by the attacker (PR:N), and the vector is network-reachable (AV:N) with low complexity (AC:L). The prerequisite conditions are: the target WordPress site must be running the Manual - Documentation, Knowledge Base & Education theme at version 7.5.4 or earlier, and a user must interact with the malicious payload for the script to execute. The primary limiting factors are the mandatory user-interaction step and the niche deployment footprint of this specific theme; there is no indication a special non-default theme configuration is required, though the exact vulnerable parameter is not specified in the provided data.

The provided CVSS 3.1 score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L: network-reachable, low complexity, no privileges required, but crucially requiring user interaction (UI:R) - a victim must click a crafted link or load attacker-controlled content. This is not a wormable, no-interaction bug, which tempers real-world urgency. There is no CISA KEV listing and no public exploit identified at time of analysis; no EPSS score or SSVC decision data was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The scope change (S:C) and unauthenticated vector raise the ceiling of impact, but the UI:R requirement and the fact that this is a niche theme (not a ubiquitous plugin) make widespread automated exploitation unlikely. Net: a legitimate patch-worthy High for sites running this theme, but not an emergency comparable to a no-interaction RCE. Note the low C/I/A partial impacts are consistent with XSS rather than server compromise.

An attacker crafts a URL or web content containing a malicious script payload targeting a vulnerable parameter handled by the Manual theme and lures a site visitor or logged-in administrator into clicking it. When the victim's browser renders the unsanitized response, the script executes in the site's origin - potentially stealing session cookies, performing actions as the victim, or defacing content. No public POC was provided in the input, and the attack requires the victim's interaction (UI:R) to succeed.