EUVD-2026-64807
GHSA-w6g6-8fcq-mj98
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
XSS requires victim interaction and changes scope to browser context; availability impact removed as XSS does not meaningfully affect service availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Urna <= 2.6.2 versions.
AnalysisAI
Unauthenticated cross-site scripting in the Urna WordPress theme (by Thembay) affects all versions up to and including 2.6.2, allowing a remote attacker to inject malicious scripts into pages viewed by other users. The scope-changed CVSS vector (S:C) confirms the payload executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS vector (PR:N) confirms no attacker authentication is required - the vulnerability is exploitable by any unauthenticated remote party who can submit input to the vulnerable theme endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.1 is driven primarily by the scope change (S:C) and zero-privilege network attack vector (AV:N/PR:N), which meaningfully elevates the score beyond the low individual C/I/A impacts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to update the Urna theme to a version newer than 2.6.2 if a patched release has been issued by Thembay; the Patchstack advisory at https://patchstack.com/database/wordpress/theme/urna/vulnerability/wordpress-urna-theme-2-6-2-cross-site-scripting-xss-vulnerability should be consulted for the confirmed fix version, which is not independently verified in the current data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all WordPress installations for Urna theme version 2.6.2 or earlier; immediately disable the theme on production sites and activate a patched alternative, or if that is not possible, deploy a Web Application Firewall rule blocking script injection payloads to this theme's endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today