PT-2026-27916 · Skygroup · Skygroup Sanzo

Published 2026-03-25 · Updated 2026-03-30 · CVE-2026-25355

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions skygroup Sanzo versions prior to 2.4.3

Description The software contains a flaw due to improper handling of user-supplied data when creating web pages, leading to a potential cross-site scripting (XSS) issue. Specifically, the vulnerability allows for stored XSS attacks. This means that malicious scripts can be injected into the application and stored, potentially affecting other users who access the compromised content.

Recommendations Update skygroup Sanzo to version 2.4.3 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-25355

Affected Products

Skygroup Sanzo

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-25355 · Security Note
• https://twitter.com/CVEnew/status/2038517003926073480 · Twitter Post
• https://patchstack.com/database/Wordpress/Theme/sanzo/vulnerability/wordpress-sanzo-theme-2-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve · Note