CVE-2026-24949

The ThemeGoods PhotoMe WordPress theme versions up to and including 5.7.1 contain a DOM-based Cross-Site Scripting (XSS) vulnerability. The root cause is improper neutralization of user-supplied input during web page generation, allowing attackers to inject malicious scripts that execute in the context of the victim's browser [1].

Exploitation

Exploitation requires a privileged user (e.g., administrator) to perform an action such as clicking a crafted link or visiting a specially prepared page. The attack is client-side and does not need authentication against the server directly, but relies on user interaction [1].

Impact

Successful exploitation enables an attacker to inject arbitrary scripts, redirect visitors, display advertisements, or insert other HTML payloads into the site. This can lead to defacement, data theft from authenticated users, or distribution of malware [1].

Mitigation

The vendor has released version 5.7.2 which resolves the vulnerability. Users are strongly advised to update immediately. As a temporary measure, Patchstack offers a mitigation rule to block attacks until the update is applied [1].