What is the CVSS score of EUVD-2026-58084?

EUVD-2026-58084 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Samex WooCommerce Theme are affected by EUVD-2026-58084?

Two WooCommerce WordPress themes (Samex through version 2.5 and M.Anh through version 1.7) contain unpatched reflected cross-site scripting vulnerabilities that enable unauthenticated attackers to…

How to fix or mitigate EUVD-2026-58084?

Within 24 hours, audit your WordPress environment to identify any active deployments of Samex (version 2.5 or earlier) or M.Anh (version 1.7 or earlier) and assess their public-facing exposure. Within 7 days, immediately deactivate these themes and switch to patched or alternative WooCommerce themes; scan all affected sites for evidence of compromise including unauthorized admin accounts and suspicious access logs. Within 30 days, establish vendor monitoring for security patches, deploy Web Application Firewall rules to detect and block XSS payloads targeting these vulnerabilities, and conduct security awareness training on phishing and malicious link risks.

Samex WooCommerce Theme EUVD-2026-58084

| CVE-2026-28154 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-13 Patchstack

GHSA-7j49-7w6m-5r8m

WordPress XSS Samex Clean Minimal Shop Woocommerce Wordpress Theme M Anh Fashion Woocoommerce Wordpress Theme Wordpress Theme

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network-reachable reflected XSS with no attacker authentication and a browser-scope change; availability set to N since reflected XSS does not disrupt service availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:58 vuln.today

CVE Published

Aug 13, 2026 - 14:25 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS.

This issue affects Samex - Clean, Minimal Shop WooCommerce WordPress Theme: from n/a through 2.5; M.Anh - Fashion WooCoommerce WordPress Theme: from n/a through 1.7.

AnalysisAI

Reflected cross-site scripting in two snstheme WooCommerce WordPress themes - Samex (through version 2.5) and M.Anh (through version 1.7) - permits unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a specially crafted URL that the theme reflects back unsanitized into the HTML response. The scope change (S:C) in the CVSS vector indicates that successful exploitation extends impact beyond the WordPress application into the victim's browser origin, enabling session hijacking or administrative account compromise. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; discovery was reported by Patchstack.

Technical ContextAI

Both affected products are WordPress themes built on the WooCommerce e-commerce framework, identified by CPE strings cpe:2.3:a:snstheme:samex_-_clean,_minimal_shop_woocommerce_wordpress_theme and cpe:2.3:a:snstheme:m.anh_-_fashion_woocoommerce_wordpress_theme. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: one or more HTTP query parameters accepted by the theme's frontend rendering logic are echoed back into the HTML response without adequate encoding or escaping. WordPress themes commonly introduce this class of vulnerability when failing to apply built-in sanitization functions such as esc_html(), esc_attr(), or wp_kses() to values sourced from $_GET or $_REQUEST. WooCommerce augments the URL parameter surface area through shop filtering, sorting, and product search endpoints, each of which can serve as a reflection point if not explicitly sanitized by the theme layer.

RemediationAI

The primary remediation is to update each affected theme to a version released after the stated vulnerability ceiling - Samex beyond version 2.5 and M.Anh beyond version 1.7 - if patched releases have been issued by snstheme. Exact fixed version numbers are not confirmed in the available intelligence; verify current patch status directly via the Patchstack advisories at https://patchstack.com/database/wordpress/theme/samex/vulnerability/wordpress-samex-clean-minimal-shop-woocommerce-wordpress-theme-theme-2-5-cross-site-scripting-xss-vulnerability and https://patchstack.com/database/wordpress/theme/manh/vulnerability/wordpress-m-anh-theme-1-7-reflected-cross-site-scripting-xss-vulnerability. If no updated theme version is confirmed available, compensating controls include activating Patchstack's virtual patching layer or a WAF rule set targeting reflected XSS payloads in shop query parameters, which blocks exploitation without requiring a code change but must remain active until the underlying defect is patched. Additionally, deploying a strict Content-Security-Policy header that disallows unsafe-inline scripts will reduce the blast radius of any payload that bypasses WAF rules, though this may interfere with WooCommerce checkout scripts and requires testing. If the themes are not actively required, deactivating them eliminates the attack surface entirely.