CVE-2026-10077: YooTheme WordPress Theme Stored XSS via Author Role

Technical summary

The YooTheme framework fails to properly sanitize HTML attributes that WordPress's wp_kses_post() function permits in post content. The vulnerability stems from a gap between WordPress's allowlist-based sanitization and YooTheme's interpretation of those attributes as executable markup rather than static content. An Author-role user can craft a post containing specially-formed HTML attributes that pass WordPress validation but trigger unintended script execution when the theme's front-end processes the post. This is a classic stored XSS scenario where the malicious payload persists in the database and executes in the security context of any viewer's session.

Business impact

Author-level accounts—often granted to contributors, editors, or third-party content creators—can compromise the integrity of any user's WordPress session who views their posts. Attackers could steal session tokens, manipulate site content, extract sensitive data, or perform administrative actions if a high-privilege user views the malicious post. For multi-author sites, customer portals, or collaborative platforms using YooTheme, this creates a privilege-escalation path from Author to Administrator. The attack is silent and persistent; victims may not realize their accounts have been compromised until unauthorized changes appear.

Affected systems

YooTheme WordPress theme versions prior to 5.0.35 are affected. The vulnerability requires Author-level access or higher; sites that restrict post creation to Editors, Administrators, or trusted contributors face reduced risk but are not immune if any of those accounts are compromised. WordPress sites running YooTheme should check their installed version immediately.

Exploitability

This vulnerability is moderately exploitable within an organization. It requires an attacker to already possess Author-level credentials—a significant but achievable foothold in multi-user WordPress environments. No network-based unauthenticated exploitation is possible. The attack succeeds reliably once credentials are obtained; the attacker simply publishes a post and waits for other users to view it. UI interaction by the victim (viewing the post) is required, but viewing published content is routine behavior. The CVSS score of 6.8 reflects the need for elevated privileges and user interaction, offset against high impact to confidentiality, integrity, and availability.

Remediation

Update YooTheme to version 5.0.35 or later immediately. The patch addresses the framework's attribute handling to align with WordPress's sanitization model. Organizations should prioritize this update for any YooTheme-powered site with multiple authors or public contributor access. After patching, audit recent posts from Author-level accounts for suspicious markup; existing malicious posts should be reviewed or removed.

Patch guidance

Visit the YooTheme support or downloads page, verify the current theme version in your WordPress dashboard (Appearance > Themes), and apply the update to version 5.0.35 or newer. Most WordPress hosting environments allow one-click theme updates; if automatic updates are not enabled, consider enabling them after this patch is released. Test the site functionality post-update, particularly page rendering and form submissions, to ensure no regressions with your site's content or extensions. For staging environments, test first before applying to production.

Detection guidance

Check wp-content/themes/ for YooTheme and confirm its version via the theme's style.css or the WordPress admin dashboard. Monitor post content for unusual HTML attributes, particularly data-* or on* event handlers (onclick, onload, etc.) that may bypass wp_kses_post if processed by the framework. Log failed sanitization attempts if your site logging is configured to capture them. Review post revisions and author activity for any suspicious edits or posts from Author accounts created shortly before unusual site behavior. A Web Application Firewall (WAF) can flag requests containing obfuscated script payloads, though XSS via HTML attributes may evade some signature-based detection.

Why prioritize this

Although the CVSS score is moderate (6.8), the practical risk is elevated for multi-author sites. Author-level access is commonly granted and can be obtained through phishing, credential reuse, or direct employment. Stored XSS against administrative users is a reliable privilege-escalation vector. Sites with guest contributors, plugin developers, or external partners holding Author roles should patch within 1-2 weeks. Single-author blogs with restricted post access can defer slightly longer but should still prioritize within a month.

Risk score, explained

CVSS 3.1 score of 6.8 (MEDIUM) reflects: Attack Vector = Network (remote exploitation possible once inside); Attack Complexity = Low (no special conditions needed); Privileges Required = High (Author role needed); User Interaction = Required (target user must view the post); Scope = Unchanged (impact within the same security context); Confidentiality/Integrity/Availability = High (attacker can steal data, modify content, or disrupt service if they escalate to admin). The score appropriately captures the requirement for elevated initial access while acknowledging the severe impact of successful exploitation.

Frequently asked questions