Is CVE-2026-65483 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65483 being exploited in the wild.

How severe is CVE-2026-65483?

Medium severity, with a CVSS score of 5.9, published 23 July 2026.

Which products and versions are affected?

HashThemes Demo Importer <= 1.4.2.

Is there a fix for CVE-2026-65483?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-65483 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-65483?

Check whether you run HashThemes Demo Importer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65483: HashThemes Demo Importer XSS in WordPress plugin

Q: Is there a fix for CVE-2026-65483?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-65483 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-65483?

Check whether you run HashThemes Demo Importer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65483 · Severity: medium · CVSS 5.9 · Published 2026-07-23

The HashThemes Demo Importer plugin for WordPress, which helps users import pre-made website designs, contains a security flaw that allows users with 'Author' privileges to inject malicious scripts. If an administrator or another user views the affected content, these scripts could execute, potentially leading to unauthorized actions or the redirection of visitors to malicious websites. This risk is primarily internal, requiring an existing account with high-level permissions to initiate.

Vendors: HashThemes.

Quick answers

Is CVE-2026-65483 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65483 being exploited in the wild.
How severe is CVE-2026-65483?: Medium severity, with a CVSS score of 5.9, published 23 July 2026.
Which products and versions are affected?: HashThemes Demo Importer <= 1.4.2.
Is there a fix for CVE-2026-65483?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-65483 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-65483?: Check whether you run HashThemes Demo Importer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the HashThemes Demo Importer plugin for WordPress (versions <= 1.4.2) due to improper neutralization of input during web page generation (CWE-79). The flaw allows an authenticated attacker with 'Author' or higher privileges to inject malicious JavaScript payloads into the site. Exploitation requires a victim (such as an administrator) to interact with the affected page or perform a specific action. Successful exploitation can lead to session hijacking, unauthorized administrative actions, or site defacement. As of the advisory date, no official patch has been confirmed.

Affected products

HashThemes HashThemes Demo Importer <= 1.4.2

Timeline

2026-01-18: other: Vulnerability reported by researcher Mike Montoya
2026-07-22: advisory: Patchstack advisory published
2026-07-23: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.