CVE-2026-81291: WordPress Uncode theme <= 2.12.7 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Uncode Themeto a version that resolves this vulnerability.Fixed in 2.12.8
Event History
Frequently Asked Questions
Who can exploit this issue?
The issue is described as unauthenticated, so an attacker does not need a WordPress account or existing credentials. Exploitation still requires user interaction, as indicated by the UI:R vector.
Which installations are affected?
WordPress sites using the Uncode theme at version 2.12.7 or earlier are affected according to the provided information.
What impact can successful exploitation have?
The supplied severity vector indicates low confidentiality, integrity, and availability impact, with scope changed. As an XSS issue, successful exploitation may allow attacker-supplied script to run in a user’s browser after the required interaction.