Description

Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-31T21:17:50.053Z",
  "pubdate": "2026-08-31T21:17:50.053Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability exists in Uncode versions 2.12.7 and earlier.\nThis vulnerability allows remote, unauthenticated attackers to inject malicious JavaScript payloads into the victim's browser session through the application.\nSuccessful exploitation compromises the integrity and confidentiality of the user's session, potentially leading to unauthorized actions, session hijacking, or credential theft.\nThe flaw stems from insufficient input sanitization of user-supplied data before rendering it within the web interface.\nRisk is significant as it requires no prior authentication or administrative privileges to execute the attack.\nThe vulnerability exposes both administrators and regular site visitors to potential client-side code execution.",
  "technicalDetails": "The vulnerability is a reflected Cross-Site Scripting (XSS) flaw identified in Uncode versions up to 2.12.7.\nThe root cause is the inadequate sanitization and improper escaping of input parameters that are reflected back to the user in the HTTP response.\nIn a typical attack flow, an attacker crafts a malicious URL containing a crafted JavaScript payload within an input parameter handled by the Uncode theme.\nWhen a user, such as an administrator, clicks on this specially crafted link, the server processes the input and includes the unencoded script tag or event handler in the rendered HTML document.\nThe victim's web browser then interprets the payload as legitimate code belonging to the site, executing the script within the context of the current session origin.\nBecause this vulnerability is unauthenticated, the attacker does not need to bypass any login mechanism, relying solely on the victim interacting with the malicious URI.\nPayload behavior typically involves executing arbitrary JavaScript in the victim's browser, which can be leveraged to steal session cookies (document.cookie), redirect the user to a malicious domain, perform unauthorized administrative actions (Cross-Site Request Forgery via XSS), or deface the site content for the specific user.\nThe exploitation occurs at the application layer, targeting the rendering engine where input is reflected without contextual encoding.\nSince the script executes in the context of the authenticated victim, if the victim is an administrator, the attacker can effectively take control of the WordPress site by adding new accounts or modifying site settings.\nThe attack is persistent across the browser session until the script is executed, and its impact is limited only by the permissions of the victim interacting with the malicious request."
}