Executive brief
The Artale theme for WordPress, designed for wedding photography websites, is vulnerable to a security flaw that allows attackers to inject malicious scripts. If a site administrator or visitor clicks a specially crafted link, the attacker can execute code in their browser, potentially leading to unauthorized actions, website defacement, or the theft of sensitive session information. As of the latest report, no official patch has been released by the developer.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the Artale | Wedding Photography WordPress theme (versions <= 2.2.2) due to improper neutralization of user-supplied input during web page generation (CWE-79). The vulnerability is unauthenticated and follows a reflected attack pattern, requiring a victim (typically a site administrator) to interact with a malicious link or crafted page (UI:R). Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session, which can lead to session hijacking or unauthorized administrative actions. At the time of disclosure, no official patch is available from the vendor.
Affected products
- ThemeGoods Artale | Wedding Photography WordPress Theme <= 2.2.2
Timeline
- 2025-11-07: other: Vulnerability reported by researcher João Pedro S Alcântara
- 2026-06-30: advisory: Initial advisory published by Patchstack
- 2026-07-02: disclosed: CVE published to the NVD dataset