Flatastic Theme CVE-2026-66673

The target WordPress site must have the Flatastic theme (version <= 2.0) installed and active as the rendered front-end theme - a deactivated or non-default theme does not expose the vulnerable code path. Active user interaction is required (UI:R): the victim must be socially engineered into clicking a specially crafted URL pointing to the affected site. No server-side configuration beyond theme activation is required. The attacker requires no authentication (PR:N). Impact is highest when the victim is an authenticated WordPress administrator, as their session context provides privileged site access; however, any authenticated or unauthenticated user clicking the link will have JavaScript execute in their browser context, potentially exposing session data or enabling clickjacking/phishing overlays.

The CVSS 3.1 base score of 7.1 is driven primarily by the network attack vector (AV:N), low complexity (AC:L), no required privileges for the attacker (PR:N), and the Scope:Changed flag. The mandatory user interaction requirement (UI:R) is the principal limiting factor - exploitation is not fire-and-forget and requires social engineering to deliver a crafted URL to a victim. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified. The vulnerability is absent from the CISA KEV catalog, and no POC or active exploitation is reported by Patchstack or referenced sources. Real-world priority is moderate: the attack is low-friction to craft once the injection point is known, but the social engineering dependency tempers widespread automated exploitation risk. The impact is most acute if a targeted victim is a WordPress site administrator, as XSS in that context can enable full site compromise via admin session hijacking. For sites where Flatastic is installed but unused or unadvertised, the practical risk is further reduced.

An attacker identifies a WordPress site running the Flatastic theme, crafts a URL with a JavaScript payload embedded in a vulnerable query parameter, and delivers it to a site administrator via a phishing email or malicious link. When the administrator clicks the link while logged into WordPress, the script executes in their browser, exfiltrating their session cookie or wp-nonce to an attacker-controlled server, enabling the attacker to authenticate as the administrator and take over the site.