Description
Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions.
Published: 2026-10-10
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Reflected Cross‑Site Scripting (XSS) that can compromise website integrity and user sessions
Action: Apply Patch
AI Analysis

Impact

Unauthenticated Cross Site Scripting in the Ambed WordPress theme (≤ 1.0.0) exposes a content injection flaw that allows an attacker to embed and execute arbitrary JavaScript in a victim’s browser. Based on the description, it is inferred that the vulnerability can be used to hijack user sessions, deface the site, or deliver phishing, credential‑stealing, or other client‑side attacks. The weakness is a classic input‑validation error (CWE‑79).

Affected Systems

The issue affects the Bracketweb Ambed theme, versions 1.0.0 and earlier, used with WordPress sites. Users running any of these releases are vulnerable.

Risk and Exploitability

The score of 7.1 on the CVSS v3 scale indicates a high impact due to the user‑interaction requirement and high damage potential. No EPSS information is published and the vulnerability is not listed in the CISA KEV catalog, though its unconditional availability to unauthenticated users makes it relatively easy to exploit by simply visiting a crafted URL. The risk can be considered moderate to high for sites that rely on the vulnerable theme.

Generated by OpenCVE AI on October 10, 2026 at 21:38 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Ambed theme to the latest available version (≥ 1.0.1) or apply the vendor‑supplied patch documented at https://patchstack.com/database/wordpress/theme/ambed/vulnerability/wordpress-ambed-theme-1-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
  • If an upgrade is not feasible, disable or delete the Ambed theme and install a trusted alternative that does not expose the vulnerability
  • Deploy a web application firewall or enforce a Content Security Policy that blocks inline scripts to mitigate the impact of any remaining XSS payloads

Generated by OpenCVE AI on October 10, 2026 at 21:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 11 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 10 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions.
Title WordPress Ambed theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-11T11:42:58.736Z

Reserved: 2026-07-13T06:14:48.065Z

Link: CVE-2026-62064

cve-icon Vulnrichment

Updated: 2026-10-11T11:40:12.379Z

cve-icon NVD

Status : Deferred

Published: 2026-10-10T20:16:40.883

Modified: 2026-10-13T13:28:15.717

Link: CVE-2026-62064

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-10T21:45:17Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')