CVE-2026-94058: WordPress Treck theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Treck treck allows Reflected XSS.This issue affects Treck: from n/a through 1.0.0.
Affected Software
Event History
Frequently Asked Questions
Which installations should be treated as affected?
Bracketweb Treck installations running version 1.0.0 or an earlier affected release should be treated as vulnerable. The affected range is listed as through 1.0.0, with no lower version bound specified.
What does an attacker need to exploit this issue?
The vector indicates network-based exploitation with low attack complexity and no attacker privileges required. User interaction is required, meaning exploitation depends on a user interacting with attacker-controlled content or a crafted request.
What is the expected impact if exploitation succeeds?
The CVSS vector indicates low potential impact to confidentiality, integrity, and availability. The scope is changed, which indicates the vulnerable component can affect resources beyond its own security authority.