CVE-2026-5070: Vantage <= 1.20.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Block Text Content
The Vantage theme for WordPress is vulnerable to Stored Cross-Site Scripting via Gallery block text content in versions up to, and including, 1.20.32 due to insufficient output escaping in the gallery template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5070?
CVE-2026-5070 is rated as a high severity vulnerability due to its potential for exploiting stored cross-site scripting.
How do I fix CVE-2026-5070?
To fix CVE-2026-5070, update the Vantage theme to version 1.20.33 or later, which contains the necessary security patches.
What versions are affected by CVE-2026-5070?
CVE-2026-5070 affects all versions of the Vantage theme up to and including 1.20.32.
What is Stored Cross-Site Scripting in the context of CVE-2026-5070?
Stored Cross-Site Scripting, as noted in CVE-2026-5070, refers to an attacker being able to inject malicious scripts into the Gallery block text content that can execute in users' browsers.
Who is impacted by CVE-2026-5070?
Users of the Vantage theme for WordPress, particularly those with Contributor-level access, are at risk of exploitation through CVE-2026-5070.