CVE-2026-6646

Vulnerability

Overview

The vulnerability resides in the 'dt_default_button' shortcode of the The7 theme for WordPress. The 'title' component of the 'link' shortcode parameter is not properly sanitized or escaped before being stored, enabling the injection of arbitrary web scripts. This issue affects all versions up to and including 14.3.2 [1].

Exploitation

Prerequisites

An authenticated attacker with at least Contributor-level access can exploit this flaw by crafting a malicious 'title' value within the shortcode. When the page containing the injected shortcode is viewed by any user, the stored script executes in the context of the victim's browser [1].

Impact

Successful exploitation leads to Stored Cross-Site Scripting (XSS), which can be used to steal session cookies, redirect users to malicious sites, deface pages, or perform other actions on behalf of the victim. The attack does not require any special network position beyond standard WordPress contributor capabilities [1].

Mitigation

The issue has been addressed in version 14.3.3, released on May 8, 2026, as noted in the theme's changelog. Users are strongly advised to update to the latest version to eliminate the vulnerability [1].