EUVD-2026-48124
GHSA-cprc-gjfg-j6gj
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Contributor account required (PR:L) and victim must view content (UI:R); scope changes to victim browser context (S:C); XSS does not meaningfully impair availability, so A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
AnalysisAI
Stored Cross-Site Scripting in the Manual - Documentation, Knowledge Base & Education WordPress Theme (versions 7.5.4 and earlier) allows authenticated Contributor-level users to inject persistent malicious scripts into theme-managed content. When a higher-privileged user such as an editor or administrator views the affected content, the script executes within their browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. No active exploitation is confirmed (not listed in CISA KEV) and no public proof-of-concept code has been identified at time of analysis.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize or encode user-supplied input before rendering it in HTML output. In this case, the Manual theme by PixelAce HQ - a WordPress theme designed for documentation and knowledge base sites - fails to properly sanitize contributor-submitted content, allowing raw script tags or event handler payloads to persist in the database and render in other users' browsers. The CVSS scope metric is Changed (S:C), confirming that the injected script escapes the vulnerable theme component and executes in the victim browser's security context rather than the originating web application's scope. The CPE cpe:2.3:a:pixelacehq:manual_-_documentation,_knowledge_base_&_education_wordpress_theme identifies PixelAce HQ as the vendor and targets all versions up to and including 7.5.4.
RemediationAI
The primary remediation is to update the Manual WordPress Theme to a version beyond 7.5.4 via the WordPress theme update mechanism or the PixelAce HQ distribution channel; the exact patched version is not independently confirmed from the available data and should be verified via the Patchstack advisory at https://patchstack.com/database/wordpress/theme/manual/vulnerability/wordpress-manual-documentation-knowledge-base-education-wordpress-theme-theme-7-5-4-cross-site-scripting-xss-vulnerability or the theme vendor's changelog before deploying. As a compensating control while awaiting a patch, administrators should restrict the Contributor role to only trusted, vetted users and disable open or semi-open contributor registration if present. Additionally, deploying a WordPress security plugin with content filtering capabilities (such as Patchstack or Wordfence) can provide virtual patching against known XSS payload patterns. Note that virtual patching may introduce false positives on legitimate content containing angle brackets or JavaScript-like syntax in documentation articles.
Sensitive information disclosure in the pixelacehq "Manual" WordPress theme (versions 7.5.4 and earlier) lets remote una
Reflected/stored Cross-Site Scripting in the Manual - Documentation, Knowledge Base & Education WordPress theme (pixelac
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today