CVE-2026-5077: Total <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Blog Section Image alt Attribute
The Total theme for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.2.1 due to insufficient output escaping when rendering thetitle() inside HTML attribute context in the home blog section template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the malicious post to be published and displayed with a featured image in the Home Page blog section.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5077?
CVE-2026-5077 is classified as a medium severity vulnerability due to its potential for exploitation in stored cross-site scripting attacks.
How do I fix CVE-2026-5077?
To fix CVE-2026-5077, update the Total WordPress theme to version 2.2.2 or later, which addresses the stored cross-site scripting vulnerability.
Who is affected by CVE-2026-5077?
Users of the Total WordPress theme version 2.2.1 or earlier are affected by CVE-2026-5077.
What type of vulnerability is CVE-2026-5077?
CVE-2026-5077 is a stored cross-site scripting (XSS) vulnerability.
Can CVE-2026-5077 be exploited by unauthenticated users?
No, CVE-2026-5077 requires an authenticated user with Contributor or higher privileges to exploit the vulnerability.