PT-2026-36597 · WordPress · Total

Published 2026-05-02 · Updated 2026-05-02 · CVE-2026-5077

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Total theme for WordPress versions prior to 2.2.2

Description Stored Cross-Site Scripting is possible via post titles due to insufficient output escaping when rendering the the title() function inside HTML attribute context in the home blog section template. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts execute when a user accesses an injected page, provided the malicious post is published and displayed with a featured image in the Home Page blog section.

Recommendations Update to a version later than 2.2.1.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-5077

Affected Products

Total

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-5077 · Security Note
• https://themes.trac.wordpress.org/changeset/320590/total · Note
• https://twitter.com/infoflowcloud/status/2050524557899878546 · Twitter Post
• https://twitter.com/CVEnew/status/2050523099842433217 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b1749bef-0952-4530-b607-4574765d2700?source=cve · Note