CVE-2026-32518

The Gaea WordPress theme versions prior to 3.8 contain a reflected cross-site scripting (XSS) vulnerability due to improper neutralization of user input during web page generation. This flaw occurs when the theme outputs query parameters without proper sanitization or encoding, enabling script injection.

An attacker can exploit this by crafting a malicious URL containing a JavaScript payload. The victim must be lured into clicking the link, which triggers the execution of the injected script in the context of the victim's browser session. No authentication is required for the initial request, but the attack depends on user interaction.

Successful exploitation could allow the attacker to perform actions such as redirecting the user to phishing sites, displaying advertisements, or stealing sensitive information like session cookies. The CVSS score of 7.1 indicates a high severity, and the vulnerability is expected to be used in mass-exploit campaigns targeting WordPress sites.

Users are advised to update the Gaea theme to version 3.8 or later as soon as possible. If an immediate update is not possible, applying a mitigation rule (e.g., from Patchstack) can block known attack vectors until the patch is applied [1].