CVE-2026-22455
Reflected XSS in Thebe ≤ 1.3.0 Enables Script Injection
Publication date: 2026-03-05
Last updated on: 2026-03-09
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| foreverpinetree | thebe | From 1.0 (inc) to 1.3.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-22455 is a medium severity Cross Site Scripting (XSS) vulnerability affecting the WordPress Thebe Theme versions up to and including 1.3.0.
This vulnerability allows an attacker to inject malicious scripts—such as redirects, advertisements, or other HTML payloads—into a website, which execute when visitors access the compromised site.
It is classified under the OWASP Top 10 category A3: Injection.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to malicious scripts running in the context of the affected website, potentially redirecting users, displaying unwanted advertisements, or executing other harmful HTML payloads.
This can compromise the security and trustworthiness of the website, potentially leading to user data exposure or manipulation.
The attack requires user interaction, such as clicking a malicious link or visiting a crafted page, but does not require authentication.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
CVE-2026-22455 is a reflected Cross Site Scripting (XSS) vulnerability affecting the WordPress Thebe Theme up to version 1.3.0. Detection typically involves testing for injection of malicious scripts via user input fields or URLs that the theme processes.
Common detection methods include using web vulnerability scanners or manual testing by injecting typical XSS payloads into URL parameters or form inputs and observing if the payload is executed or reflected in the page without proper neutralization.
Specific commands are not provided in the available resources, but you can use tools like curl or wget to send crafted requests, or use browser developer tools to test input fields for script injection.
What immediate steps should I take to mitigate this vulnerability?
Since no official patch is available for CVE-2026-22455, immediate mitigation involves applying the Patchstack mitigation rule designed to block attacks exploiting this vulnerability.
Users should promptly implement this mitigation to prevent exploitation, which may include blocking malicious input patterns or filtering suspicious requests targeting the vulnerable theme.
Additionally, limiting user interaction with untrusted links and educating users about the risk of clicking suspicious URLs can reduce the chance of exploitation.