Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Wolverine Framework wolverine-framework allows Reflected XSS.This issue affects Wolverine Framework: from n/a through <= 1.9.
Published: 2026-03-25
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Untrusted user input execution via reflected cross‑site scripting
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an improper neutralization of input during web page generation in the G5Theme Wolverine Framework plugin, permitting reflected cross‑site scripting (CWE‑79). The flaw could allow an attacker to inject arbitrary JavaScript that is executed in the browser of any visitor to a crafted URL; it is inferred that such injection could be used for further malicious actions.

Affected Systems

All releases of G5Theme Wolverine Framework from its earliest version up through and including version 1.9 are affected. WordPress sites that have installed the plugin within this version range are vulnerable until the plugin is upgraded or patched.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector is remote and does not require prior authentication, since the flaw is triggered by user-supplied URL or input that is reflected to the browser.

Generated by OpenCVE AI on March 25, 2026 at 23:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Wolverine Framework to a release newer than 1.9 or apply the vendor’s official patch.
  • If an immediate upgrade is not possible, disable or remove the plugin, or restrict access to its configuration pages and eliminate any exposed input that is not properly sanitized.
  • Verify functionality after patching and monitor the vendor’s security advisories for further updates.

Generated by OpenCVE AI on March 25, 2026 at 23:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 26 Mar 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared G5theme
G5theme wolverine Framework
Wordpress
Wordpress wordpress
Vendors & Products G5theme
G5theme wolverine Framework
Wordpress
Wordpress wordpress

Wed, 25 Mar 2026 21:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 25 Mar 2026 16:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Wolverine Framework wolverine-framework allows Reflected XSS.This issue affects Wolverine Framework: from n/a through <= 1.9.
Title WordPress Wolverine Framework plugin <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References

Subscriptions

G5theme Wolverine Framework
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-24T15:25:28.176Z

Reserved: 2026-02-17T13:23:58.964Z

Link: CVE-2026-27087

cve-icon Vulnrichment

Updated: 2026-03-25T20:04:17.818Z

cve-icon NVD

Status : Deferred

Published: 2026-03-25T17:16:56.307

Modified: 2026-04-24T16:35:20.070

Link: CVE-2026-27087

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-26T12:12:35Z

Weaknesses