Cross Site Scripting (XSS) Vulnerability in Uncode Theme by WordPress
CVE-2026-81291

7.1HIGH

Key Information:

Vendor

WordPress
Status
Uncode
Vendor
CVE Published:
31 August 2026

What is CVE-2026-81291?

The Uncode Theme for WordPress, specifically versions up to 2.12.7, is susceptible to an unauthenticated Cross Site Scripting (XSS) vulnerability. This type of vulnerability allows attackers to inject malicious scripts into web pages viewed by users, potentially compromising user data and security. Such exploits can lead to session hijacking, redirect users to malicious sites, or manipulate site content. It is essential for users of this theme to update their installations to the latest version and adopt security measures to mitigate the risk associated with this vulnerability.

Affected Version(s)

Uncode <= 2.12.7

References

https://patchstack.com/database/wordpress/theme/uncode/vu...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Ba Khanh - HPT Vietnam Corporation | Patchstack Bug Bounty Program
.