CVE-2026-66612: WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerability
Published Aug 20, 2026
·Updated
Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions.
Affected Software
1 affected component
WordPress Aora theme<=1.3.19
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Aora Themeto a version that resolves this vulnerability.Fixed in 1.3.20
Event History
Aug 20, 2026
CVE Published
via MITRE·12:07 PM
Data Sourced
via MITRE·12:07 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require an account or elevated permissions?
No. The vulnerability is described as unauthenticated, so an attacker does not need a WordPress account or prior permissions.
2
Does a victim need to interact with attacker-controlled content?
Yes. The CVSS vector includes UI:R, indicating that user interaction is required for exploitation.
3
Which installations are affected?
WordPress sites using the Aora theme version 1.3.19 or earlier are affected according to the provided information.