Cross Site Scripting Vulnerability in Urna Theme by WordPress
CVE-2026-66610

7.1HIGH

Key Information:

Vendor

WordPress
Status
Urna
Vendor
CVE Published:
24 August 2026

What is CVE-2026-66610?

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in the Urna theme versions up to 2.6.2, which could allow an attacker to inject malicious scripts into the pages. This vulnerability poses a risk as it can potentially enable attackers to manipulate website content and steal sensitive information from users without their knowledge. Website owners using these versions are advised to update to the latest version to mitigate any potential security risks.

Affected Version(s)

Urna <= 2.6.2

References

https://patchstack.com/database/wordpress/theme/urna/vuln...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Khuong Hai & Thanh Nam (HPT Vietnam) | Patchstack Bug Bounty Program
.