Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup MyDecor mydecor allows Reflected XSS.This issue affects MyDecor: from n/a through < 1.5.9.
Published: 2026-03-25
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Reflected Cross‑Site Scripting
Action: Immediate Patch
AI Analysis

Impact

Improper neutralization of user input allows a reflected cross‑site scripting attack on the WordPress MyDecor theme. The vulnerability can cause malicious JavaScript to run in a visitor’s browser, potentially leading to session hijacking or defacement. This weakness is identified as CWE‑79.

Affected Systems

The vulnerability affects the skygroup MyDecor theme versions older than 1.5.9. Systems running any of these theme versions in a WordPress installation are at risk until the issue is patched.

Risk and Exploitability

The CVSS base score of 7.1 indicates a moderate to high severity. Exploit availability is currently unknown, and the vulnerability is not listed in the KEV catalog. The most likely attack vector is external web traffic that can trigger the reflected XSS payload, so any public‑facing WordPress site using an affected theme presents a direct risk.

Generated by OpenCVE AI on March 25, 2026 at 23:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the MyDecor theme to version 1.5.9 or newer.
  • Confirm the theme update by checking the WordPress admin dashboard.
  • Test the site after the upgrade to ensure no reflected XSS is triggered.

Generated by OpenCVE AI on March 25, 2026 at 23:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 26 Mar 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Skygroup
Skygroup mydecor
Wordpress
Wordpress wordpress
Vendors & Products Skygroup
Skygroup mydecor
Wordpress
Wordpress wordpress

Wed, 25 Mar 2026 21:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 25 Mar 2026 16:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup MyDecor mydecor allows Reflected XSS.This issue affects MyDecor: from n/a through < 1.5.9.
Title WordPress MyDecor theme < 1.5.9 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References

Subscriptions

Skygroup Mydecor
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-24T15:35:36.969Z

Reserved: 2026-02-02T12:52:42.959Z

Link: CVE-2026-25352

cve-icon Vulnrichment

Updated: 2026-03-25T20:06:16.192Z

cve-icon NVD

Status : Deferred

Published: 2026-03-25T17:16:46.043

Modified: 2026-04-24T16:32:53.997

Link: CVE-2026-25352

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-26T12:12:50Z

Weaknesses