Description
The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via Social Profile Fields in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is scoped to the attacker's own user meta but is exposed publicly on their author archive page at /author/<slug>/, which is accessible to unauthenticated visitors regardless of whether the attacker has published any posts.
Published: 2026-11-07
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored XSS
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a stored cross‑site scripting flaw in the social profile fields of the Soledad WordPress theme. Authenticated users with subscriber‑level access or higher can inject arbitrary JavaScript. The injected payload is stored in the user’s metadata and is rendered on the author archive page at /author/<slug>/, which is publicly accessible to any visitor, regardless of authentication.

Affected Systems

All installations of the pencidesign Soledad WordPress theme through version 8.7.7. Sites that still use any of these releases are vulnerable.

Risk and Exploitability

The risk is rated medium, with a CVSS score of 6.4. Exploitation requires an authenticated subscriber or stronger WordPress account to edit social profile fields; once the payload is stored, it is displayed to any unauthenticated visitor of the author page. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, indicating that no confirmed exploits are known at this time.

Generated by OpenCVE AI on November 7, 2026 at 09:08 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Soledad WordPress theme to version 8.7.8 or later.
  • Clear any malicious scripts from the affected social profile fields of all users.
  • Implement a content security policy that blocks inline scripts on author pages, or use a security plugin to enforce script‑execution restrictions.

Generated by OpenCVE AI on November 7, 2026 at 09:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 04:45:00 +0000

Type Values Removed Values Added
Description The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via Social Profile Fields in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is scoped to the attacker's own user meta but is exposed publicly on their author archive page at /author/<slug>/, which is accessible to unauthenticated visitors regardless of whether the attacker has published any posts.
Title Soledad <= 8.7.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Social Profile Fields
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-11-07T04:27:11.924Z

Reserved: 2026-09-18T20:39:07.105Z

Link: CVE-2026-93902

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-07T05:19:03.103

Modified: 2026-11-07T05:19:03.293

Link: CVE-2026-93902

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T09:15:14Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')