Description
Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business <= 13.3.3 versions.
Published: 2026-07-02
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The theme incorporates an unauthenticated reflected XSS flaw in all versions up to and including 13.3.3. User‑supplied query parameters are echoed back without proper sanitization, allowing an attacker to inject arbitrary JavaScript into a victim’s browser. This client‑side vulnerability can be triggered by any user visiting a crafted link and is classified as CWE‑79.

Affected Systems

WordPress installations that have installed the Themesuite Automotive Car Dealership Business theme version 13.3.3 or earlier are affected. Site owners should replace the vulnerable theme with any version newer than 13.3.3 when a release becomes available.

Risk and Exploitability

An attacker can trigger the vulnerability by crafting a URL containing malicious query parameters that the theme reflects back to the victim’s browser, allowing execution of arbitrary JavaScript. The CVSS score of 7.1 indicates high severity for this unauthenticated, client‑side flaw. The EPSS score of less than 1% suggests a very low but nonzero likelihood of exploitation. The flaw is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on July 31, 2026 at 15:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Automotive Car Dealership Business WordPress theme to any version newer than 13.3.3 to eliminate the unsanitized input handling.
  • If a theme update cannot be applied immediately, enforce a strict Content Security Policy that disallows inline JavaScript and restricts script sources to trusted domains to mitigate script execution.
  • As a temporary workaround, strip or escape query parameters before they are rendered, or use a sanitization plugin to encode output so that injected scripts cannot execute.

Generated by OpenCVE AI on July 31, 2026 at 15:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 02 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 02 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business <= 13.3.3 versions.
Title WordPress Automotive Car Dealership Business theme <= 13.3.3 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-07-02T14:46:13.248Z

Reserved: 2026-02-19T09:52:32.856Z

Link: CVE-2026-27426

cve-icon Vulnrichment

Updated: 2026-07-02T14:46:09.644Z

cve-icon NVD

Status : Deferred

Published: 2026-07-02T12:17:00.700

Modified: 2026-07-02T15:16:59.627

Link: CVE-2026-27426

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T15:15:02Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')