What is the CVSS score of CVE-2026-6646?

CVE-2026-6646 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

The7 WordPress Theme CVE-2026-6646

EUVD-2026-30509 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-15 Wordfence

GHSA-gf5v-5j65-7wpq

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 07:31 vuln.today

CVE Published

May 15, 2026 - 06:45 nvd

MEDIUM 6.4

DescriptionCVE.org

The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dt_default_button' shortcode in all versions up to, and including, 14.3.2. This is due to insufficient input sanitization and output escaping on the 'title' component of the 'link' shortcode parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting (XSS) in The7 WordPress theme versions up to 14.3.2 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via the 'title' parameter of the 'dt_default_button' shortcode. The injected scripts execute in the context of any user who views the affected page, enabling session hijacking, credential theft, or malware distribution. No public exploit code has been identified at time of analysis.

Technical ContextAI

The vulnerability exists in the 'dt_default_button' shortcode implementation within The7 theme's default-button component. The 'title' parameter of the 'link' shortcode option accepts user input but fails to properly sanitize or escape it before rendering in HTML output. This violates the WordPress security standard of sanitizing on input and escaping on output (SLEO). The CWE-79 classification confirms this is an improper neutralization of input during web page generation (Cross-site Scripting). Code references in the WordPress plugin repository (default-button.php line 112 and html-helpers.php line 945) indicate the vulnerable rendering logic persists across multiple version releases. The attack surface is limited to authenticated users with at least Contributor-level permissions, who can create or edit posts and pages containing the vulnerable shortcode.

RemediationAI

Update The7 theme to version 14.3.3 or later, which includes fixes for input sanitization and output escaping in the dt_default_button shortcode. This is available through the WordPress theme dashboard or directly from the-7.io changelog. If immediate patching is not feasible, restrict Contributor-level and Editor-level access to only trusted users who do not require shortcode creation capabilities. Alternatively, disable the 'dt_default_button' shortcode entirely via WordPress hooks or a security plugin if the shortcode is not essential to site functionality; however, this may break page layouts or functionality that depend on the button component. Website administrators should audit all existing content for suspicious shortcode parameters, particularly those containing script tags or event handlers. After patching, consider implementing a WordPress security plugin with XSS detection (such as Wordfence) to monitor for similar stored XSS attempts and add an additional layer of output validation at the theme level. Note that patching resolves the vulnerability but does not retroactively sanitize already-injected malicious content-manual content review is recommended for high-traffic sites.