CVE-2026-5077 is a stored cross-site scripting vulnerability in the Total WordPress theme by hashthemes, affecting versions up to and including 2.2.1. The issue occurs because the theme does not properly escape post titles when rendering the_title() inside an HTML attribute in the home blog section template. This allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript that executes in the context of users viewing the blog home page with the malicious post published and displayed with a featured image.

Successful exploitation allows an attacker with contributor-level access or higher to inject persistent malicious scripts into the website, which execute in the browsers of users who visit the affected blog home page. This can lead to limited confidentiality and integrity impacts such as theft of user session data or manipulation of page content. The vulnerability does not impact availability. The CVSS vector indicates network attack vector, low attack complexity, privileges required, user interaction required, and scope change.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory for updates. Until a patch is released, restrict contributor-level access to trusted users only and consider disabling the display of featured images on the home blog section to reduce exposure. Applying output escaping or sanitization manually in the theme code may mitigate the issue if feasible.