# CVE-2026-94061: Designthemes Whistle - Sports Club reflected XSS

Source: https://junglewise.ai/threats/cve-2026-94061-improper-neutralization-of-input-during-web-page-generation-cross  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-94061 · Severity: high · CVSS 7.1 · Published 2026-10-09

Whistle - Sports Club is a WordPress theme for sports club websites. The theme contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages viewed by site visitors. An attacker could exploit this by crafting a malicious link that, when clicked by a victim, steals their data or hijacks their account without requiring authentication.

Vendors: [Designthemes](https://junglewise.ai/threats/vendors/designthemes).

## Quick answers

**Is CVE-2026-94061 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94061 being exploited in the wild.

**How severe is CVE-2026-94061?** High severity, with a CVSS score of 7.1, published 9 October 2026.

**Which products and versions are affected?** Designthemes Whistle - Sports Club through 4.2.

**Is there a fix for CVE-2026-94061?** No fixed version is recorded yet. Patchstack has issued a mitigation rule to block attacks until an official patch becomes available. Apply this mitigation rule immediately if an official patch from the vendor is not yet available.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-09"},{"kind":"advisory","at":"2026-10-07","note":"Patchstack published security advisory"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-94061 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-94061?** Check whether you run Designthemes Whistle - Sports Club at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Patchstack has issued a mitigation rule to block attacks until an official patch becomes available. Apply this mitigation rule immediately if an official patch from the vendor is not yet available.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-09"},{"kind":"advisory","at":"2026-10-07","note":"Patchstack published security advisory"}]

## Technical details

This is a reflected XSS vulnerability in the Whistle - Sports Club WordPress theme affecting versions through 4.2. The vulnerability requires user interaction (clicking a malicious link) but no authentication or special privileges. Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser within the site's security context, enabling session hijacking, credential theft, or site defacement.

## Affected products

- Designthemes Whistle - Sports Club through 4.2

## References

- [https://themeforest.net/](https://themeforest.net/)
- [https://patchstack.com/database/wordpress/theme/whistle-sports-club/vulnerability/wordpress-whistle-sports-club-theme-4-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/theme/whistle-sports-club/vulnerability/wordpress-whistle-sports-club-theme-4-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve)