PT-2026-23185 · Thebi · Thebi

Tran Nguyen Bao Khanh · Published 2026-03-05 · Updated 2026-03-08 · CVE-2026-22438

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions TheBi versions through 1.0.5

Description The software contains a flaw due to improper handling of user-supplied data when creating web pages, which can lead to Reflected Cross-Site Scripting (XSS). This allows an attacker to inject malicious scripts into a web page viewed by another user. The vulnerability exists because the application does not adequately sanitize user input before including it in the generated HTML output. The vulnerable component is susceptible to attacks where an attacker crafts a malicious URL containing the XSS payload. When a user clicks on this URL, the malicious script is executed in their browser within the context of the vulnerable website. This could allow the attacker to steal cookies, redirect the user to a malicious website, or modify the content of the web page.

Recommendations Update TheBi to a version greater than 1.0.5.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-22438

Affected Products

Thebi

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-22438 · Security Note
• https://patchstack.com/database/Wordpress/Theme/thebi/vulnerability/wordpress-thebi-theme-1-0-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2030755358445048170 · Twitter Post