EUVD-2025-210238Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify WordPress site running Folo ≤1.9.6
-
DeliveryCraft URL with reflected XSS payload
-
ExploitPhish administrator with crafted link
-
InstallVictim clicks while logged in
-
C2Payload executes in admin's browser
-
ExecuteHijack session or create rogue admin
-
ImpactPersist site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to deliver a crafted URL containing the malicious payload to a victim who must click it (UI:R) while their browser can reach the target Folo-powered WordPress site, and meaningful impact requires the victim to be authenticated to that site - ideally as an administrator - because the XSS executes in the victim's session context. The vulnerable code path is only reachable on WordPress installations running the Themify Folo theme at version 1.9.6 or earlier; sites on other themes or patched Folo releases are not in scope. No authentication is required of the attacker (PR:N), but the requirement for user interaction and a privileged victim is the principal limiting factor. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L describes a network-reachable, low-complexity, unauthenticated attack that needs a user to click a crafted link, with a scope change reflecting impact across the browser security boundary; the 7.1 score is elevated mainly by the scope change, not by direct technical impact. Real-world risk is moderate: the bug requires social engineering of a privileged WordPress user to achieve meaningful damage, and there is no EPSS score, no KEV listing, and no public PoC in the provided intelligence, indicating no evidence of mass exploitation. The Patchstack reference confirms the issue but provides no signal of active campaigns, so this should be prioritized like a typical reflected XSS in a WordPress theme - patch promptly, but it is unlikely to be opportunistically mass-exploited. |
| Exploit ScenarioDerived | An attacker crafts a URL pointing at a Folo-powered WordPress site with a malicious payload in a reflected parameter and delivers it via phishing email, a forum post, or a malicious ad to a site administrator. When the administrator clicks the link while logged in, the injected script executes in their browser session and can steal authentication cookies, create a new admin account via the REST API, or modify site content. No public PoC is identified in the supplied intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Reflected cross-site scripting in the Themify Folo WordPress theme (versions up to and including 1.9.6) allows remote attackers to execute arbitrary JavaScript in a victim's browser when the victim clicks a crafted link. The flaw is reported by Patchstack with a CVSS 3.1 base score of 7.1 driven by scope change and user interaction; no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis - the Patchstack advisory documents the flaw through version 1.9.6 but does not cite a fixed version in the supplied data, so administrators should monitor https://patchstack.com/database/wordpress/theme/folo/vulnerability/wordpress-themify-folo-theme-1-9-6-reflected-cross-site-scripting-xss-vulnerability and the Themify vendor channel for an updated Folo release and upgrade as soon as it is published. In the interim, deploy a WordPress-aware WAF rule (Patchstack, Wordfence, or equivalent) to filter reflected XSS payloads against the theme's request parameters, set a strict Content-Security-Policy header that disallows inline scripts to blunt payload execution (note this may break theme features that rely on inline JS and should be tested), restrict /wp-admin access by IP allowlist so administrators are less reachable by phishing links, and consider temporarily switching to another theme if the site has high-value admin accounts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Themify Folo is a commercial WordPress theme distributed by Themify, identified by CPE cpe:2.3:a:themify:themify_folo. The root cause is CWE-79, Improper Neutralization of Input During Web Page Generation, meaning one or more request parameters rendered by the theme are echoed back into an HTML response without sufficient output encoding or input sanitization. Because the payload is delivered in the request and reflected in the response, attacker-supplied script executes in the origin of the WordPress site, giving access to cookies, the DOM, and any logged-in session - including administrator sessions when an admin is lured to the crafted URL.
Know when Themify Folo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Reflected XSS reachable over the network without authentication but requiring a victim click; scope changes to the browser and impacts are limited to session-level confidentiality, integrity, and availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Folo allows Reflected XSS.
This issue affects Themify Folo: from n/a through 1.9.6.
Executive ViewAI
The Themify Folo WordPress theme through version 1.9.6 contains a reflected cross-site scripting vulnerability that could allow attackers to inject arbitrary JavaScript code into website visitor browsers through crafted links. Organizations deploying this theme on public websites face risk of credential theft, session hijacking, and malware distribution targeting end-users and damaging organizational reputation. While no public exploit identified at time of analysis, the attack requires only social engineering to distribute malicious links and presents ongoing risk until the affected theme is patched or replaced.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately disable affected theme versions and migrate to alternative WordPress theme; (2) Deploy Web Application Firewall with XSS detection and sanitization rules; (3) Implement Content Security Policy headers to restrict inline script execution; (4) Monitor web logs for XSS payload attempts; (5) Conduct end-user awareness training on avoiding untrusted links to organizational websites.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
GitHub PoC
Exploit-DB