Executive brief
The 'my flatonica' theme for WordPress is vulnerable to a security flaw that allows attackers to inject malicious scripts into the website. This occurs when a user clicks on a specially crafted link, potentially leading to unauthorized actions performed in the user's browser, such as data theft or site redirection. As there is currently no official patch from the developer, website owners should consider alternative themes or use web application firewalls to block suspicious traffic.
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in the 'my flatonica' WordPress theme through version 0.0.8. The flaw stems from improper neutralization of user-supplied input during web page generation (CWE-79). An unauthenticated remote attacker can exploit this by sending a crafted URL to a user; if the user visits the link, the attacker's script executes within the context of the user's session. This can lead to session hijacking, unauthorized administrative actions, or website defacement. No official patch has been released by the vendor as of the advisory date.
Affected products
- Mythemes my flatonica <= 0.0.8
Timeline
- 2024-06-11: disclosed: Reported by researcher justakazh
- 2024-10-14: advisory: Patchstack published advisory details
- 2026-06-17: advisory: NVD published CVE record