Executive brief
Uncode is a popular WordPress theme used to design and manage website content. An unauthenticated attacker can inject malicious scripts into web pages that are then executed in the browsers of visitors, potentially stealing login credentials, session tokens, or other sensitive user data. While user interaction is required (clicking a malicious link), the ease of distribution through social engineering makes this a significant risk to websites and their users.
Technical details
This is a stored or reflected cross-site scripting (XSS) vulnerability in the Uncode WordPress theme that does not require authentication to exploit. The vulnerability exists in versions 2.12.7 and earlier. An attacker can craft a malicious request or URL that injects JavaScript code into the website; when a user visits the compromised page or clicks a malicious link, the injected script executes in their browser with access to their session and cookies. The vulnerability was patched in version 2.12.8. Exploitation requires user interaction (victim must click a link or visit a crafted page), but can be distributed at scale through social engineering or compromised referrers.
Affected products
- Uncode Uncode <= 2.12.7
Timeline
- 2026-08-27: disclosed
- 2026-08-27: patched: Version 2.12.8 released