Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop WooCommerce WordPress Theme: from n/a through 2.5; M.Anh - Fashion WooCoommerce WordPress Theme: from n/a through 1.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-13T15:19:39.213Z",
  "pubdate": "2026-08-13T15:19:39.213Z",
  "executiveSummary": "A Cross-site Scripting (XSS) vulnerability exists due to improper neutralization of user-supplied input during web page generation in multiple WooCommerce WordPress themes developed by snstheme.\nThe affected software includes Samex - Clean, Minimal Shop WooCommerce WordPress Theme and M.Anh - Fashion WooCoommerce WordPress Theme.\nThis security flaw allows a remote attacker to execute arbitrary client-side scripts within the context of a victim's browser session by tricking them into interacting with a maliciously crafted URL.\nSuccessful exploitation of this vulnerability can lead to session hijacking, credential theft, malicious redirection, and the manipulation of rendered Document Object Model (DOM) content on the targeted WordPress site.\nThe vulnerability requires no authentication by default, relying instead on social engineering vectors to deliver the payload via the web application's HTTP request parameters.",
  "technicalDetails": "The vulnerability stems from an absence of adequate input sanitization and output encoding mechanisms within the handling of HTTP request parameters across the vulnerable theme codebase.\nSpecifically, the application takes user-supplied data and reflects it directly back into the generated HyperText Markup Language (HTML) response without properly neutralizing special characters such as angle brackets (< and >), quotation marks, and JavaScript event handlers.\nThe root cause is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).\nThe affected components are the Samex - Clean, Minimal Shop WooCommerce WordPress Theme (versions from n/a through 2.5) and the M.Anh - Fashion WooCoommerce WordPress Theme (versions from n/a through 1.7).\nBecause the flaw is exposed over the network via standard HTTP/HTTPS protocols, an unauthenticated remote attacker can construct a malicious URL containing an encoded script payload (e.g., JavaScript injected via an unvalidated parameter).\nThe attack flow proceeds as follows: First, the attacker crafts a malicious link containing the payload and distributes it to potential victims via phishing, forums, or other communication vectors. Second, the victim clicks the link, sending an HTTP request containing the malicious payload to the WordPress server running the vulnerable theme. Third, the theme processes the request and incorporates the unescaped parameter value directly into the HyperText Markup Language response sent back to the browser. Fourth, the victim's browser parses the HTTP response, fails to recognize the input as untrusted data, and executes the embedded script within the security context of the origin site.\nPost-exploitation impact includes the potential theft of sensitive session cookies, bypass of access controls, modification of page content to deceive users, and unauthorized execution of actions on behalf of the authenticated user."
}