CVE-2026-17025: Graphene <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields
The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Can an unauthenticated visitor exploit this issue?
No. Exploitation requires an authenticated WordPress account with at least Subscriber-level access.
Where should administrators look for potentially malicious content?
Review user profile values for the Current location and Author profile image URL fields. Injected scripts execute when a user accesses a page containing the affected content.
Which installations are known to be affected?
Graphene versions through 2.9.4, including 2.9.4, are affected.