Graphene
Monthly
Stored or reflected Cross-Site Scripting in the Graphene WordPress theme (by silverks) version 2.9.4 and earlier allows a low-privileged Subscriber-level user to inject malicious JavaScript that executes in the browser of any higher-privileged user who views the affected content. The scope change (S:C) in the CVSS vector confirms impact extends beyond the attacker's own session to other users, enabling session hijacking, credential theft, or privilege escalation against site administrators. No public exploit code or active exploitation has been identified at time of analysis, but Patchstack has reported and documented the issue.
Stored or reflected Cross-Site Scripting in the Graphene WordPress theme (by silverks) version 2.9.4 and earlier allows a low-privileged Subscriber-level user to inject malicious JavaScript that executes in the browser of any higher-privileged user who views the affected content. The scope change (S:C) in the CVSS vector confirms impact extends beyond the attacker's own session to other users, enabling session hijacking, credential theft, or privilege escalation against site administrators. No public exploit code or active exploitation has been identified at time of analysis, but Patchstack has reported and documented the issue.