CVE-2026-78289: WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (XSS) vulnerability
Published Aug 27, 2026
·Updated
Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions.
Affected Software
1 affected component
WordPress CozyStay theme<=1.10.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress CozyStay Themeto a version that resolves this vulnerability.Fixed in 1.10.1
Event History
Aug 27, 2026
CVE Published
via MITRE·09:00 AM
Data Sourced
via MITRE·09:00 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this vulnerability?
The issue is described as unauthenticated, so an attacker does not need a WordPress account or other prior privileges. Exploitation does require user interaction, as reflected by the UI:R metric.
2
Which installations are affected?
WordPress sites using the CozyStay theme version 1.10.0 or earlier are affected according to the available data.
3
What impact can successful exploitation have?
The supplied CVSS vector indicates low impact to confidentiality, integrity, and availability, with scope changed. The vulnerability is classified as cross-site scripting.