{"id":"CVE-2026-111838","kind":"vulnerability","aliases":["CVE-2026-111838"],"related":[],"title":"ThemeHunk Customizer WordPress plugin: reflected XSS through 2.8.7","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected XSS.This issue affects ThemeHunk Customizer: from n/a through 2.8.7.","summary":"ThemeHunk Customizer, a WordPress plugin, does not neutralize input in generated pages, enabling reflected cross-site scripting. An attacker who gets a victim to open a crafted link can run script in the victim's browser session on the affected site.","severity":"high","cvss":7.1,"epss":0.00202,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","themehunk-customizer","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get themehunk-customizer --field=version`\n- Compare against the fixed release named in the advisory; the sources do not give a fixed version","fix":"- Update ThemeHunk Customizer (`themehunk-customizer`) to a version later than `2.8.7`; the sources do not name the exact fixed release\n- If no fixed version exists, deactivate and remove the plugin","status":"open","published_at":"2026-10-21T15:17:15+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:31:50+00:00","updated_at":"2026-10-25T03:31:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:31:50Z","model":"claude-haiku-5-5","output":{"fix":"- Update ThemeHunk Customizer (`themehunk-customizer`) to a version later than `2.8.7`; the sources do not name the exact fixed release\n- If no fixed version exists, deactivate and remove the plugin","reach":"internet","title":"ThemeHunk Customizer WordPress plugin: reflected XSS through 2.8.7","impact":"medium","summary":"ThemeHunk Customizer, a WordPress plugin, does not neutralize input in generated pages, enabling reflected cross-site scripting. An attacker who gets a victim to open a crafted link can run script in the victim's browser session on the affected site.","category":"package","nicknames":[],"who_cares":["wordpress","themehunk-customizer"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs script in a victim's browser on the site","analyst_note":"Confirm the fixed version and whether authentication or a specific page is needed; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111838.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get themehunk-customizer --field=version`\n- Compare against the fixed release named in the advisory; the sources do not give a fixed version","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running ThemeHunk Customizer version `2.8.7` or earlier are affected. The sources do not say which settings or pages are needed to trigger the flaw, so treat any site with the plugin active as exposed. Sites that do not have the plugin installed can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000644,"input_tokens":3366,"output_tokens":615,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111838':11A,14A '-2026':10A,13A '2.8.7':8A,92C 'affect':60B,86C 'allow':82C 'attack':39B 'browser':56B 'craft':47B 'cross':35B,71C 'cross-sit':34B,70C 'custom':2A,18B,21B,78C,81C,88C 'cve':9A,12A 'enabl':32B 'generat':30B,69C 'get':41B 'improp':62C 'input':28B,65C 'issu':85C 'link':48B 'n/a':90C 'neutral':27B,63C 'open':45B 'packag':15B 'page':31B,68C 'plugin':4A,24B 'reflect':5A,33B,83C 'run':50B 'script':37B,51B,73C 'session':57B 'site':36B,61B,72C 'themehunk':1A,17B,20B,76C,77C,80C,87C 'themehunk-custom':16B,79C 'victim':43B,54B 'vulner':74C 'web':67C 'wordpress':3A,19B,23B 'xss':6A 'xss.this':84C","nicknames":[],"mitigations":[],"who_affected":"Sites running ThemeHunk Customizer version `2.8.7` or earlier are affected. The sources do not say which settings or pages are needed to trigger the flaw, so treat any site with the plugin active as exposed. Sites that do not have the plugin installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T15:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111838","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111838","severity":null,"published_at":"2026-10-21T15:17:15+00:00","modified_at":"2026-10-21T18:19:16+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111838","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111838","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}