CVE-2026-10077 Overview
CVE-2026-10077 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the YOOtheme WordPress theme in versions prior to 5.0.35. The theme's bundled front-end framework treats certain HTML attributes permitted by wp_kses_post() as executable markup. Authenticated users with the Author role can inject persistent JavaScript payloads into posts. The payload executes in the browser of any user, including administrators, who views the affected post.
Critical Impact
Authenticated Authors can inject stored JavaScript that executes against administrators and site visitors, enabling session hijacking, privilege escalation, and account takeover.
Affected Products
- YOOtheme WordPress theme versions prior to 5.0.35
- WordPress sites using the YOOtheme bundled front-end framework
- Any WordPress installation permitting Author-role content submission with YOOtheme active
Discovery Timeline
- 2026-07-02 - CVE CVE-2026-10077 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-10077
Vulnerability Analysis
The vulnerability lies in the interaction between WordPress's wp_kses_post() sanitization function and the YOOtheme front-end framework. wp_kses_post() permits a set of HTML attributes considered safe in standard post content. The YOOtheme framework, however, interprets specific permitted attributes as framework directives or executable markup during client-side rendering. This mismatch allows an attacker to bypass sanitization by embedding payloads within attributes that WordPress considers benign but the theme processes as active markup.
Exploitation requires authenticated access with the Author role and user interaction from a victim who views the post. Successful exploitation yields script execution under the origin of the affected WordPress site.
Root Cause
The root cause is inadequate coordination between server-side sanitization and client-side attribute interpretation. wp_kses_post() was not designed to strip framework-specific directive attributes because those attributes are valid HTML. The YOOtheme framework then elevates these attributes to executable behavior without a secondary sanitization pass. This is a classic sanitizer-parser mismatch producing Stored Cross-Site Scripting [CWE-79].
Attack Vector
An attacker authenticates as an Author, then submits a post containing crafted HTML attributes recognized by the YOOtheme front-end framework. The post passes wp_kses_post() validation. When an administrator or other user renders the post, the framework processes the attributes and executes attacker-controlled JavaScript in the victim's browser context. See the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-10077
Indicators of Compromise
- Post content authored by Author-role accounts containing framework-specific directive attributes such as uk-* or similar YOOtheme prefixes with suspicious values
- Unexpected outbound requests from administrator browsers immediately after viewing user-submitted posts
- New administrator accounts or role changes correlated with Author account activity
- WordPress audit log entries showing content edits by Authors followed by administrative session activity
Detection Strategies
- Scan the wp_posts table for HTML attributes matching YOOtheme framework directives in content authored by non-administrator accounts
- Monitor WordPress REST API and /wp-admin/post.php requests for payloads containing framework attribute syntax
- Deploy Content Security Policy (CSP) reporting endpoints to capture inline script violations originating from post views
Monitoring Recommendations
- Log and review all Author-role post submissions and revisions for anomalous HTML attribute usage
- Alert on privilege changes, plugin installations, or user creation events that follow shortly after post views
- Ingest WordPress access logs and PHP error logs into a centralized SIEM for correlation across authentication and content events
How to Mitigate CVE-2026-10077
Immediate Actions Required
- Update the YOOtheme WordPress theme to version 5.0.35 or later on all affected sites
- Audit existing posts authored by Author-role accounts for injected framework attributes and remove suspicious content
- Rotate administrator credentials and invalidate active sessions if Authors are untrusted or if compromise is suspected
- Review user role assignments and remove Author privileges from accounts that do not require them
Patch Information
The vendor addressed the issue in YOOtheme theme version 5.0.35. The fix prevents the bundled front-end framework from treating wp_kses_post()-permitted attributes as active markup. Refer to the WPScan Vulnerability Report for the confirmed fixed version.
Workarounds
- Restrict the Author role to trusted users only until patching is complete
- Require administrator review and approval for all posts submitted by Author-role accounts
- Deploy a strict Content Security Policy that disallows inline scripts and untrusted event handlers
- Use a Web Application Firewall (WAF) rule to block requests containing YOOtheme framework directive attributes from non-administrator sessions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
