Gaea EUVD-2026-15880

Reflected XSS in imithemes Gaea versions below 3.8. Remote unauthenticated attacker crafts malicious URL containing unescaped input. Victim must click the link or visit the crafted page in a browser.

While a CVSS vector and EPSS score are not available for this CVE, the vulnerability presents meaningful real-world risk based on available signals. The reflected XSS classification (CWE-79) typically carries moderate severity in CVSS terms, often ranging from 6.1 (Medium) to 8.2 (High) depending on attack vector and required privileges. As a WordPress theme vulnerability affecting a publicly distributed product, the attack vector is likely 'Network' and requires minimal user interaction (a single click). The primary mitigating factor is that exploitation requires social engineering; however, the theme's widespread use in WordPress installations amplifies impact. No public exploit code (POC) confirmation is documented in available intelligence, and KEV status is not indicated, suggesting this may not yet be actively exploited at scale. The fact that a patched version (3.8) exists and was released indicates vendor responsiveness. For WordPress site operators, this should be treated as a medium-priority update given the prevalence of XSS attacks and the ease of patching WordPress themes.

An attacker crafts a malicious URL containing JavaScript payload in a query parameter known to be reflected by the Gaea theme without sanitization—for example, a search parameter or custom theme filter. The attacker sends this URL via email or social media to a WordPress site administrator or content editor, pretending it links to relevant content. When the victim clicks the link and the page renders, the injected JavaScript executes in their browser with their authentication context, allowing the attacker to steal their WordPress session token, create backdoor admin accounts, or inject malicious content into posts. No public proof-of-concept is currently documented, but the reflected XSS vector requires only a single user click to succeed.