Thembay
Monthly
Unauthenticated cross-site scripting in the Urna WordPress theme (by Thembay) affects all versions up to and including 2.6.2, allowing a remote attacker to inject malicious scripts into pages viewed by other users. The scope-changed CVSS vector (S:C) confirms the payload executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege attack path lowers the barrier for opportunistic exploitation against sites running the vulnerable theme.
Unauthenticated cross-site scripting in the Aora WordPress theme (all versions through 1.3.19) enables remote attackers to inject and execute arbitrary JavaScript in the browsers of site visitors without any prior authentication. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms this is network-reachable with low complexity, requiring only that a victim interact with a crafted link or page - a realistic bar for phishing-assisted delivery. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated nature and scope-changed impact (S:C) elevate real-world concern for sites running this theme.
The search functionality of the Greenmart theme 2.4.2 for WordPress is vulnerable to XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated cross-site scripting in the Urna WordPress theme (by Thembay) affects all versions up to and including 2.6.2, allowing a remote attacker to inject malicious scripts into pages viewed by other users. The scope-changed CVSS vector (S:C) confirms the payload executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege attack path lowers the barrier for opportunistic exploitation against sites running the vulnerable theme.
Unauthenticated cross-site scripting in the Aora WordPress theme (all versions through 1.3.19) enables remote attackers to inject and execute arbitrary JavaScript in the browsers of site visitors without any prior authentication. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms this is network-reachable with low complexity, requiring only that a victim interact with a crafted link or page - a realistic bar for phishing-assisted delivery. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated nature and scope-changed impact (S:C) elevate real-world concern for sites running this theme.
The search functionality of the Greenmart theme 2.4.2 for WordPress is vulnerable to XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.