EUVD-2026-96424
GHSA-j947-jvf8-j6qh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious URL with XSS payload
-
DeliveryDeliver link to victim via phishing
-
ExploitVictim clicks link on vulnerable site
-
ExecutionPayload reflected and executed in browser
-
ImpactSteal session or forge admin actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to deliver a crafted link containing the XSS payload to a user and have that user click it while interacting with a site running the Kids Planet theme (version through 2.2.14.2) - this user-interaction requirement (UI:R) is the key limiting factor and means there is no unattended/automatable exploitation. Impact is greatest when the clicking victim is an authenticated administrator, since the injected script runs with that user's session context (S:C scope change). No special non-default server configuration is identified in the description; the specific vulnerable parameter/endpoint is not disclosed in the provided data. |
| Impact | This is a reflected cross-site scripting flaw (CWE-79) in the ThemeREX 'Kids Planet' WordPress theme, reported by Patchstack with a vendor CVSS of 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The network vector and no-privilege requirement raise the raw score, but the mandatory user interaction (UI:R) is the dominant limiting factor: a victim must be lured into clicking an attacker-crafted link, so exploitation is per-victim and social-engineering-dependent rather than automatable or wormable. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT on the CISA KEV list and no public exploit code was referenced - exploitation status is therefore 'no public exploit identified at time of analysis.' Reflected XSS is a common, well-understood bug class that is rarely a mass-exploitation priority on its own; its realistic worst case is session/cookie theft or action-forgery against an authenticated administrator who clicks a malicious link. Net assessment: a legitimate HIGH-severity hygiene issue worth patching, but not an emergency given the UI requirement, absence of KEV/POC signals, and the niche footprint of the affected theme. Note the A:L (availability) impact in the vendor vector is atypical for reflected XSS and is not substantiated by the description - treat it with caution. |
| Exploit ScenarioDerived | An attacker crafts a URL to a Kids Planet-powered WordPress site containing a malicious script payload in a reflected parameter and sends it to a logged-in user (ideally an administrator) via phishing. When the victim clicks the link, the unsanitized input is reflected into the page and the script executes in their browser session, allowing cookie/session theft or forged administrative actions. No public exploit code was referenced, and success requires the victim to interact with the crafted link. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Reflected cross-site scripting in the ThemeREX Group "Kids Planet" WordPress theme (all versions through 2.2.14.2) lets a remote, unauthenticated attacker lure a victim to a crafted link that causes attacker-controlled script to execute in the victim's browser within the context of the affected site. Because the injected code inherits the browsing context of whoever clicks the link, a logged-in administrator is the highest-value target, where the flaw can enable session or content manipulation; the required user interaction (UI:R) is the key limiting factor and rules out unattended, automatable exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor score of 7.1 reflects moderate confidentiality, integrity, and availability weighting.
RemediationAI
Apply the fixed build of the Kids Planet theme as soon as ThemeREX Group publishes it; the available data does not identify a patched version, so verify the current release against the vendor and the Patchstack advisory at https://patchstack.com/database/wordpress/theme/kidsplanet/vulnerability/wordpress-kids-planet-theme-2-2-14-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve rather than assuming 2.2.14.2 is the final affected release, and re-check the changelog for an explicit XSS fix before considering the install covered. Because exploitation is reflected and requires a victim to click a crafted link, the most effective compensating controls are defensive filtering and user behavior: deploy virtual patching or a WAF rule set that detects script-bearing query strings and reflected markup on theme-rendered pages, accepting the trade-off that generic XSS signatures generate false positives on legitimate rich-content URLs and must be tuned. If the theme is not in active use, deactivate and delete it, which removes the attack surface entirely at the cost of losing its design; if it must remain, keep WordPress core, plugins, and the theme itself current, restrict administrator browsing to trusted destinations and never follow unsolicited links while logged in (session-hijack and forced-action payloads target the authenticated context specifically), and consider tightening session handling so that a stolen cookie has a shorter useful life. Note that no vendor-released patch version is identified in the provided data at time of analysis and that absence of a published fix should be treated as an open item to confirm, not as confirmation that none will be issued.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79, improper neutralization of user-supplied input during web page generation - here specifically a reflected cross-site scripting pattern in a WordPress theme. WordPress themes routinely render request-derived values (query strings, path segments, form parameters) directly into templates, and when those values reach the HTML output without context-appropriate escaping or encoding, a crafted URL can inject markup or script that the browser executes. The CPE cpe:2.3:a:themerex_group:kids_planet:*:*:*:*:*:*:*:* identifies the product as the ThemeREX Group Kids Planet theme, a commercial/third-party WordPress theme; the wildcard version component plus the reported range "through 2.2.14.2" indicates every release up to and including that build is affected. The CVSS 3.1 vector assigns AV:N and PR:N (the attack is network-delivered and no prior authentication is needed to trigger the payload), with UI:R capturing the requirement that a victim actively follows the attacker's link. The scope change (S:C) reflects that the script executes in the context of the victim site and session rather than merely affecting the vulnerable component itself, which is what elevates a reflected XSS from a nuisance to a credible session-hijack or administrative-action vector. Neither the vulnerable parameter nor the exact endpoint is disclosed in the available data, so any reproduction or signature work must begin from the Patchstack advisory. No non-default server configuration is identified as a prerequisite.
Know when Kids Planet gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Reflected XSS is remote and unauthenticated but requires victim click (UI:R) and crosses into the browser context (S:C); confidentiality/integrity impact is limited (session/action) and availability does not realistically apply (A:N).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS.
This issue affects Kids Planet: from n/a through 2.2.14.2.
Executive ViewAI
The ThemeREX Group Kids Planet WordPress theme, used on affected sites through version 2.2.14.2, carries a high-severity vulnerability (CVE-2026-57742) that can be triggered when a user follows a crafted link, with logged-in administrators as the highest-value target because their sessions can be manipulated. With no vendor-released patch identified at time of analysis, affected organizations face elevated risk of unauthorized website content changes or administrative session abuse. Leadership should prioritize identifying and mitigating any sites using this theme; no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis; interim mitigations include disabling or removing the Kids Planet theme if not required, restricting administrative access, enforcing MFA and least privilege, blocking reflected XSS attempts at the WAF, and monitoring for suspicious administrator or content activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB