CVE-2026-54870: WordPress Weaver Xtreme theme Support plugin <= 7.0.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweaver Weaver Xtreme Theme Support weaverx-theme-support allows Stored XSS.This issue affects Weaver Xtreme Theme Support: from n/a through 7.0.1.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability requires low-privileged access and user interaction. It is remotely reachable, but the provided data does not identify the specific WordPress role or interaction required.
Which installations may be affected?
Weaver Xtreme Theme Support versions through 7.0.1 are affected. The available information does not state whether the vulnerable behavior is enabled in a default configuration.
What is the potential impact of successful exploitation?
A successful exploit can result in stored cross-site scripting, with low impacts to confidentiality, integrity, and availability. The scope is changed, indicating the impact may extend beyond the vulnerable component's security authority.