Description
Unauthenticated Cross Site Scripting (XSS) in Sonaar <= 4.27.4 versions.
Published: 2026-06-17
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Unauthenticated Cross Site Scripting (XSS) is present in versions of the WordPress Sonaar theme up to 4.27.4. An attacker can inject arbitrary script into page content that is rendered for any visitor. This can lead to session hijacking, defacement, or malicious redirects. The weakness originates from unsanitized input handling in the theme’s template files, consistent with CWE‑79.

Affected Systems

The affected product is the WordPress Sonaar theme supplied by SONAAR MUSIC:Sonaar. Versions 4.27.4 and earlier are vulnerable. Any WordPress site that has installed one of these versions is at risk.

Risk and Exploitability

The CVSS score of 7.1 indicates a high‑level impact. EPSS is not available, so current exploit probability is unknown. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw is unauthenticated and relies on user‑controlled input, an attacker can exploit it from any remote host that can load the affected pages. No additional authentication or privileged conditions are required.

Generated by OpenCVE AI on June 18, 2026 at 12:31 UTC.

Remediation

Vendor Solution

Update the WordPress Sonaar theme to the latest available version (at least 4.27.5).

OpenCVE Recommended Actions

  • Update the Sonaar theme to version 4.27.5 or newer.
  • If an immediate update is not possible, apply a web application firewall or enforce a strict content security policy that blocks inline scripts to mitigate the risk while a patch is applied.
  • Review and modify the theme’s template files to ensure that all user‑supplied data is escaped using WordPress functions such as esc_html() or esc_js().

Generated by OpenCVE AI on June 18, 2026 at 12:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 21 Jun 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Sonaar Music
Sonaar Music sonaar
Wordpress
Wordpress wordpress
Vendors & Products Sonaar Music
Sonaar Music sonaar
Wordpress
Wordpress wordpress

Thu, 18 Jun 2026 04:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 17 Jun 2026 11:15:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in Sonaar <= 4.27.4 versions.
Title WordPress Sonaar theme <= 4.27.4 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Sonaar Music Sonaar
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-06-17T15:32:34.855Z

Reserved: 2025-09-17T18:00:53.704Z

Link: CVE-2025-59560

cve-icon Vulnrichment

Updated: 2026-06-17T13:30:37.582Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-20T23:04:57Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')