EUVD-2026-41252
GHSA-76v2-c9r8-5q7q
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Author role is low-privilege (PR:L not PR:H); stored XSS crosses browser security boundary requiring S:C; no direct availability impact applies.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
5DescriptionCVE.org
The yootheme WordPress theme before 5.0.35 does not prevent its bundled front-end framework from treating certain HTML attributes, which are permitted by wp_kses_post(), as markup, allowing users with the Author role to perform Stored Cross-Site Scripting attacks that execute in the browser of any user who views the affected post.
AnalysisAI
Stored XSS in the yootheme WordPress theme before version 5.0.35 enables users holding the Author role to inject persistent malicious scripts into posts by exploiting a sanitization gap between WordPress's wp_kses_post() filter and the theme's bundled front-end framework, which interprets certain permitted HTML attributes as executable markup. Any visitor - including site administrators - who views an affected post triggers script execution in their browser, creating a realistic privilege escalation path on multi-author WordPress sites. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; vendor patch version 5.0.35 is confirmed via WPScan advisory.
Technical ContextAI
The root cause is an impedance mismatch between WordPress's core HTML sanitizer, wp_kses_post(), and the custom front-end framework bundled with the yootheme theme. WordPress's wp_kses_post() is designed to permit a defined allowlist of HTML attributes considered safe for post content; however, the yootheme front-end framework separately processes those same attribute values as executable markup directives, effectively re-interpreting sanitized input in an unsafe context. This is a secondary-processing injection pattern - the sanitizer approves the payload, and the framework then acts on it. While no CWE is formally assigned in the available data, this aligns with CWE-79 (Improper Neutralization of Input During Web Page Generation / Stored XSS) and CWE-116 (Improper Encoding or Escaping of Output). Affected scope per EUVD-2026-41252: yootheme WordPress theme, all versions from 0 up to (not including) 5.0.35.
RemediationAI
Upgrade the yootheme WordPress theme to version 5.0.35 or later, which is the vendor-confirmed fix per the WPScan advisory (https://wpscan.com/vulnerability/89877758-50f1-4a4b-a622-e417571a5b14/) and EUVD-2026-41252. If immediate upgrade is not feasible, demote untrusted Author-role accounts to the Contributor role, which requires editorial approval before posts are published and prevents unapproved HTML content from reaching visitors - this eliminates the publishing prerequisite but disrupts multi-author publishing workflows. Additionally, deploying a Content Security Policy (CSP) header that restricts inline script execution can reduce the impact of XSS payloads if they fire, though it does not address the underlying injection condition and may break legitimate theme JavaScript. Web application firewall (WAF) rules targeting attribute-based XSS patterns in POST bodies can provide partial mitigation but risk false positives on legitimate content. The vendor patch is the only complete resolution.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Share
External POC / Exploit Code
Leaving vuln.today