CVE-2025-26934

WordPress Glossy Blog theme <= 1.0.3 - Cross Site Scripting (XSS) vulnerability

View on CVE.org
Published Apr 15, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in graphthemes Glossy Blog glossy-blog allows Stored XSS.This issue affects Glossy Blog: from n/a through <= 1.0.3.

Analysis

AI-generated

Technical impact

The vulnerability is a stored cross‑site scripting flaw that allows an attacker to inject arbitrary scripts into the Glossy Blog theme, enabling malicious code to run in the browsers of site visitors.

Affected Systems

The flaw affects the WordPress Glossy Blog theme from version n/a through 1.0.3, which is used on any WordPress installation with that theme active.

Risk and Exploitability

The CVSS score is 6.5, indicating a moderate severity. The EPSS score is below 1 percent, suggesting a low probability of exploitation at present, and the vulnerability is not currently listed in the CISA KEV catalog. The typical attack vector is an attacker who gains the ability to create or edit content within the theme, such as a contributor or admin user. The malicious script would then be presented to all users who view the affected page, leading to potential data theft or defacement.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest version of the Glossy Blog theme (>=1.0.4) which removes the stored XSS issue.
  • Disable or remove any user roles that can insert unfiltered HTML into the site, such as limiting contributor capabilities.
  • If an upgrade cannot be applied immediately, sanitize or escape all content rendered by the theme, or deactivate the theme until a patch is available.

Generated by OpenCVE AI on May 1, 2026 at 10:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-11115 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in graphthemes Glossy Blog allows Stored XSS. This issue affects Glossy Blog: from n/a through 1.0.3.
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in graphthemes Glossy Blog allows Stored XSS. This issue affects Glossy Blog: from n/a through 1.0.3. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in graphthemes Glossy Blog glossy-blog allows Stored XSS.This issue affects Glossy Blog: from n/a through <= 1.0.3.
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in graphthemes Glossy Blog allows Stored XSS. This issue affects Glossy Blog: from n/a through 1.0.3.
Title WordPress Glossy Blog theme <= 1.0.3 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:11 PM
Reserved
Feb 17, 2025, 11:51 AM

View source JSON

Updated
Apr 16, 2025, 1:37 PM

JSON

Status
Deferred
Published
Apr 15, 2025, 10:15 PM
Modified
Jun 17, 2026, 9:02 AM

View source JSON

No data.

Updated
May 1, 2026, 10:30 AM

JSON