Description
Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions.
Published: 2026-08-06
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an unauthenticated cross‑site scripting flaw present in Thrive Architect plugin versions up to 10.9.3.1, allowing attackers to inject arbitrary HTML or JavaScript into the site. The weakness is classified as CWE‑79 and can lead to script execution in visitors’ browsers, potentially compromising user data and site integrity.

Affected Systems

Thrive Themes’ Thrive Architect plugin for WordPress, versions up to and including 10.9.3.1, affects any WordPress installation that has the plugin installed.

Risk and Exploitability

The flaw carries a CVSS score of 7.1, indicating high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via unauthenticated submission of malicious scripts in editable content fields. Once triggered, the injected code can run in the context of any visitor’s browser, allowing data theft, defacement, or further site compromise.

Generated by OpenCVE AI on August 6, 2026 at 16:05 UTC.

Remediation

Vendor Solution

Update the WordPress Thrive Architect Plugin to the latest available version (at least 10.9.3.2).

OpenCVE Recommended Actions

  • Update the WordPress Thrive Architect plugin to a version at least 10.9.3.2.
  • If an immediate update is not possible, restrict editor access to trusted users or disable the plugin until the patch is applied.
  • Identify and delete any malicious scripts that may have been injected into page or post content to mitigate current risk before the patch.

Generated by OpenCVE AI on August 6, 2026 at 16:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 08 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Thrive Themes Coupon
Thrive Themes Coupon thrive Architect
Wordpress
Wordpress wordpress
Vendors & Products Thrive Themes Coupon
Thrive Themes Coupon thrive Architect
Wordpress
Wordpress wordpress

Thu, 06 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 06 Aug 2026 14:45:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions.
Title WordPress Thrive Architect plugin <= 10.9.3.1 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Thrive Themes Coupon Thrive Architect
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-08-06T16:42:53.704Z

Reserved: 2026-07-27T14:01:09.905Z

Link: CVE-2026-66694

cve-icon Vulnrichment

Updated: 2026-08-06T16:42:17.603Z

cve-icon NVD

Status : Deferred

Published: 2026-08-06T15:17:22.483

Modified: 2026-08-12T20:58:37.847

Link: CVE-2026-66694

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-08T20:53:56Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')