CVE-2026-6646: The7 <= 14.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 'link' Parameter
The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dtdefaultbutton' shortcode in all versions up to, and including, 14.3.2. This is due to insufficient input sanitization and output escaping on the 'title' component of the 'link' shortcode parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress The7 themeto a version that resolves this vulnerability.Fixed in 14.3.2 - Configuration
Update/modify The7 theme so that the 'title' component used in the 'link' shortcode parameter is properly sanitized and escaped in output to prevent Stored XSS (vulnerability is described as insufficient sanitization/escaping of the 'title' component).
WordPress The7 theme dt_default_button shortcode - link.title output escaping/input sanitization = Sanitize and escape the 'title' component of the 'link' shortcode parameter
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6646?
CVE-2026-6646 has a medium severity rating due to its potential for stored cross-site scripting vulnerabilities.
How do I fix CVE-2026-6646?
To fix CVE-2026-6646, update the The7 WordPress theme to version 14.3.3 or later.
Who is affected by CVE-2026-6646?
CVE-2026-6646 affects users of The7 WordPress theme versions up to and including 14.3.2.
What type of vulnerability is CVE-2026-6646?
CVE-2026-6646 is classified as a stored cross-site scripting vulnerability.
Can CVE-2026-6646 be exploited remotely?
Yes, CVE-2026-6646 can be exploited remotely by attackers who have contributor or higher privileges.