Cross-Site Scripting Vulnerability in ThemeHunk Customizer by ThemeHunk
CVE-2026-111838

7.1HIGH

Key Information:

Vendor

WordPress
Status
Themehunk Customizer
Vendor
CVE Published:
21 October 2026

What is CVE-2026-111838?

The ThemeHunk Customizer plugin is affected by a reflection cross-site scripting vulnerability that allows attackers to inject arbitrary JavaScript into web pages viewed by users. This flaw occurs because of improper input neutralization during the web page generation process, allowing malicious scripts to execute when unsuspecting users visit affected sites. The vulnerability poses a significant risk as it can exploit website visitors, potentially accessing sensitive information or hijacking user sessions.

Affected Version(s)

ThemeHunk Customizer 0 <= 2.8.7

References

https://patchstack.com/database/wordpress/plugin/themehun...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Elieve | Patchstack Bug Bounty Program
.