CVE-2026-94066: WordPress Pond theme <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability

Q: What does an attacker need to exploit this issue?

The CVSS vector indicates exploitation is network-accessible, requires low attack complexity, no privileges, and user interaction. An attacker would need to induce a user to interact with a crafted request or page.

Q: Which versions are affected?

Pond versions through 2.6.1 are affected. The available data does not identify a fixed version.

Q: What is the potential impact?

Successful reflected XSS could affect confidentiality, integrity, and availability at low impact levels. The scope is changed, meaning the impact can extend beyond the vulnerable component's security authority.

Published Oct 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpabRice Pond pond allows Reflected XSS.This issue affects Pond: from n/a through 2.6.1.

Affected Software

1 affected component

SpabRice Pond<=2.6.1

Event History

Oct 9, 2026

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The CVSS vector indicates exploitation is network-accessible, requires low attack complexity, no privileges, and user interaction. An attacker would need to induce a user to interact with a crafted request or page.

Which versions are affected?

Pond versions through 2.6.1 are affected. The available data does not identify a fixed version.

What is the potential impact?