EUVD-2026-63297
GHSA-6jr8-4mj2-3p48
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-delivered, unauthenticated XSS with scope change; availability impact removed as standard XSS does not cause service disruption.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions.
AnalysisAI
Unauthenticated cross-site scripting in the Aora WordPress theme (all versions through 1.3.19) enables remote attackers to inject and execute arbitrary JavaScript in the browsers of site visitors without any prior authentication. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms this is network-reachable with low complexity, requiring only that a victim interact with a crafted link or page - a realistic bar for phishing-assisted delivery. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target WordPress installation must be running the Aora theme by Thembay at version 1.3.19 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L reflects a genuinely accessible attack surface: network-reachable, no authentication required, and low attack complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Aora WordPress theme to a version beyond 1.3.19 as documented in the Patchstack advisory (https://patchstack.com/database/wordpress/theme/aora/vulnerability/wordpress-aora-theme-1-3-19-cross-site-scripting-xss-vulnerability?_s_id=cve). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations running the Aora theme and disable the theme immediately if not actively used; if essential, update to version 1.3.19 if not already installed, and implement Web Application Firewall (WAF) rules to block XSS payload patterns targeting this vulnerability. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today