CVE-2026-54870
6.5MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Authenticated attackers with low privileges can inject persistent malicious scripts to hijack user sessions or deface pages when victims view affected site content. Network access and at least a low-privileged WordPress account are required.
Root cause
The plugin fails to sanitize and neutralize user-supplied input before storing and rendering it into web pages.
Affected systems
Weaver Xtreme Theme Support (weaverx-theme-support) through 7.0.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Fix & remediation
Upgrade Weaver Xtreme Theme Support to a version higher than 7.0.1 once available from the vendor. If an update cannot be applied immediately, deactivate the weaverx-theme-support plugin.
$ wp plugin deactivate weaverx-theme-supportAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweaver Weaver Xtreme Theme Support weaverx-theme-support allows Stored XSS.This issue affects Weaver Xtreme Theme Support: from n/a through 7.0.1.