EUVD-2026-48117
GHSA-53c7-8pxh-9wvm
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-reachable unauthenticated XSS requiring victim interaction (UI:R); injected script crosses into the site/admin context so scope changes (S:C), with partial confidentiality/integrity/availability impact typical of XSS.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
AnalysisAI
Reflected/stored Cross-Site Scripting in the Manual - Documentation, Knowledge Base & Education WordPress theme (pixelacehq) affects all versions up to and including 7.5.4, allowing unauthenticated attackers to inject malicious script that executes in a victim's browser when they interact with a crafted link or page. Because the CVSS scope is changed (S:C), successful exploitation can impact resources beyond the theme itself, such as the WordPress admin session context. This is a Patchstack-reported issue with no public exploit identified at time of analysis and no evidence of active exploitation.
Technical ContextAI
The vulnerability is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) flaw in a WordPress presentation-layer theme. WordPress themes render user- or request-supplied data into HTML templates; when that data is echoed without proper output encoding or input sanitization, an attacker can smuggle <script> or event-handler payloads that the browser executes in the site's origin. The affected component per CPE is cpe:2.3:a:pixelacehq:manual_-_documentation,_knowledge_base_&_education_wordpress_theme, a documentation/knowledge-base/education theme by vendor PixelAce. The CVSS scope-change flag (S:C) indicates the injected script crosses a trust boundary - typically executing in the context of an authenticated admin or another user rather than only the attacker's own session.
RemediationAI
Upgrade the Manual theme to a release newer than 7.5.4 once the vendor publishes a fixed version; the Patchstack advisory (https://patchstack.com/database/wordpress/theme/manual/vulnerability/wordpress-manual-documentation-knowledge-base-education-wordpress-theme-theme-7-5-4-cross-site-scripting-xss-vulnerability-2) is the authoritative source for the patched version, which was not included in the supplied data and could not be independently confirmed. Because no fixed version is confirmed in the input (No vendor-released patch version identified at time of analysis from the provided data), apply compensating controls in the interim: deploy a WAF or virtual patch (Patchstack offers one for this CVE) to filter XSS payloads on the vulnerable request parameters; restrict or sanitize access to the theme's affected endpoints; and enforce a strict Content-Security-Policy that disallows inline script execution to blunt reflected payloads - noting CSP may break theme features that rely on inline scripts and requires testing. Educate admins not to click untrusted links pointing at the site, since exploitation requires user interaction.
Sensitive information disclosure in the pixelacehq "Manual" WordPress theme (versions 7.5.4 and earlier) lets remote una
Stored Cross-Site Scripting in the Manual - Documentation, Knowledge Base & Education WordPress Theme (versions 7.5.4 an
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today