Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweaver Weaver Xtreme Theme Support weaverx-theme-support allows Stored XSS.This issue affects Weaver Xtreme Theme Support: from n/a through 7.0.1.
Published: 2026-10-13
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: Stored Cross‑Site Scripting (XSS)
Action: Patch Immediately
AI Analysis

Impact

The Weaver Xtreme Theme Support plugin contains an input sanitization flaw that permits an attacker to inject arbitrary JavaScript into stored data, which the plugin later outputs without proper escaping. If successfully exploited, this stored XSS can deface the site, steal user credentials, or hijack user sessions, thereby compromising confidentiality and integrity of data on the affected website.

Affected Systems

The vulnerability affects the Weaver Xtreme Theme Support plugin for WordPress, specifically version 7.0.1 and all prior releases. WordPress sites using this plugin are at risk until the issue is addressed.

Risk and Exploitability

The flaw has a CVSS score of 6.5, reflecting moderate severity. An EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation generally requires access to administrative interfaces where the plugin’s input fields can be manipulated, making it a web‑application‑based attack vector.

Generated by OpenCVE AI on October 13, 2026 at 07:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the WordPress Weaver Xtreme Theme Support plugin to the latest version that removes the XSS flaw.
  • If the update is not immediately available, consider disabling or uninstalling the plugin to eliminate the attack surface.
  • Apply additional defensive measures such as a robust content‑security‑policy that blocks inline scripts and uncommented external scripts, and restrict administrative access to the plugin’s configuration pages.

Generated by OpenCVE AI on October 13, 2026 at 07:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 06:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweaver Weaver Xtreme Theme Support weaverx-theme-support allows Stored XSS.This issue affects Weaver Xtreme Theme Support: from n/a through 7.0.1.
Title WordPress Weaver Xtreme theme Support plugin <= 7.0.1 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-13T05:48:07.924Z

Reserved: 2026-06-16T09:22:12.123Z

Link: CVE-2026-54870

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-13T06:17:03.157

Modified: 2026-10-13T06:17:03.157

Link: CVE-2026-54870

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:30:15Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')