Insufficient input sanitization and output escaping in the Graphene WordPress theme’s "Current location" and "Author profile image URL" profile fields allow an authenticated user with Subscriber or higher access to insert arbitrary JavaScript into the site. Once the malicious code is stored, it is executed in the browsers of any visitor who views a page that includes the profile data, enabling session hijacking, credential theft, defacement or phishing attacks aimed at all site users.

The issue affects the Graphene theme for WordPress supplied by silverks, in all releases up to and including version 2.9.4. Versions 2.9.5 and later contain the fix.

The vulnerability has a CVSS score of 6.4, placing it in the moderate range. Exploitation requires authentication; an attacker must have at least Subscriber-level privileges to edit a profile, after which the payload propagates to every site visitor. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploit activity yet. Nevertheless, the ability to inject persistent scripts presents a significant risk to confidentiality and integrity for site users.