Description
The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-09-15
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting (XSS)
Action: Patch/Upgrade
AI Analysis

Impact

The Bridge - Creative Multipurpose WordPress Theme for WordPress is vulnerable to Stored Cross‑Site Scripting via the 'circle_line' shortcode attribute. Insufficient input sanitization and output escaping allow authenticated users with contributor-level access or higher to inject arbitrary JavaScript that will execute on any user who views the affected page.

Affected Systems

The vulnerability affects the QODE Bridge Creative Multipurpose WordPress Theme version 30.8.9.1 and all earlier releases. Users running any of those versions are at risk.

Risk and Exploitability

The flaw is a CWE‑79 stored cross‑site scripting weakness. The medium severity. Because the vulnerability requires authenticated contributor‑level access, the attack vector is limited to authenticated users. The EPSS score is < 1%, indicating a very low probability of exploitation. The issue is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on September 17, 2026 at 15:46 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Bridge theme to a version newer than 30.8.9.1 where the 'circle_line' shortcode input is properly sanitized.
  • If an immediate upgrade is not possible, restrict contributor role permissions or consider disabling the filtering or a web application firewall to sanitize input data in the shortcode before it is stored or rendered.
  • Apply a security plugin or manually enable WordPress' built‑in sanitization functions such as wp_kses_post or to mitigate potential XSS impacts.

Generated by OpenCVE AI on September 17, 2026 at 15:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Qode
Qode bridge - Creative Multipurpose Wordpress Theme
Wordpress
Wordpress wordpress
Vendors & Products Qode
Qode bridge - Creative Multipurpose Wordpress Theme
Wordpress
Wordpress wordpress

Wed, 16 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Description The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title Bridge - Creative Multipurpose WordPress Theme <= 30.8.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Qode Bridge - Creative Multipurpose Wordpress Theme
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-09-16T18:57:59.974Z

Reserved: 2026-07-13T15:55:32.450Z

Link: CVE-2026-15609

cve-icon Vulnrichment

Updated: 2026-09-16T18:57:55.805Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T13:16:40.687

Modified: 2026-09-16T19:17:06.303

Link: CVE-2026-15609

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T19:59:13Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')