CVE-2026-78534: WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS) vulnerability

Q: What access does an attacker need to exploit this issue?

No authentication is required. Exploitation does require user interaction, as reflected by the UI:R vector.

Q: What security impact can successful exploitation have?

The CVSS vector indicates low confidentiality, integrity, and availability impact, with scope changed. The issue is classified as cross-site scripting.

Published Oct 10, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.

Affected Software

1 affected component

WordPress Educavo<=3.4.2

Event History

Oct 10, 2026

CVE Published

via MITRE·07:36 PM

Data Sourced

via MITRE·07:36 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

No authentication is required. Exploitation does require user interaction, as reflected by the UI:R vector.

What security impact can successful exploitation have?