Executive brief
A vulnerability in the YOOtheme Pro WordPress theme allows users with Author-level permissions to inject malicious scripts into website posts. These scripts execute automatically in the browser of any visitor who views the affected content. This could lead to unauthorized actions being performed in the context of other users' sessions, including administrators, potentially compromising the site or its visitors.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in YOOtheme Pro before version 5.0.35. The theme's bundled front-end framework (UIkit) processes certain HTML data attributes (such as 'data-attrs', 'data-caption', or 'data-uk-tooltip') as markup. Because these specific attributes are permitted by the standard WordPress 'wp_kses_post()' sanitization function, an authenticated attacker with the Author role can bypass security filters to embed malicious JavaScript. The payload is stored in the database and executes when a victim interacts with or views the affected post elements. The issue is resolved in version 5.0.35.
Affected products
- YOOtheme YOOtheme Pro < 5.0.35
Timeline
- 2026-06-11: disclosed: Publicly published by WPScan
- 2026-07-02: advisory: NVD publication date
- 2026-05-01: patched: Fixed in version 5.0.35