CVE-2026-111838: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ThemeHunk ThemeHunk Customizer

This vulnerability in ThemeHunk Customizer arises from improper input sanitization during web page generation, leading to Reflected Cross-site Scripting (XSS). An attacker can craft malicious input that is reflected in the web page without proper neutralization, allowing script execution in the victim's browser. The affected versions are all releases prior to 2.8.8. No known exploits in the wild have been reported. The CVSS v3.1 score of 7.1 reflects network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website, potentially resulting in theft of user credentials, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability of user data. The vulnerability requires user interaction and is exploitable remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the ThemeHunk Customizer plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once released.