Threat database

3 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
Medium	6.4	EPSS 0.2%	CVE-2026-17025Graphene · Cross-site Scripting Medium6.4EPSS 0.2%2026-10-10CVE Database V5CVE-2026-17025 The Graphene WordPress theme up to version 2.9.4 contains a stored cross-site scripting (XSS) vulnerability in the 'Current location' and 'Author profile image URL' profile fields. Authenticated users with Subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping. EPSS 0.2%Vulnerability silverks #cwe-79 #ghsa-ccpv-ph2f-3cx3	CVE Database V5	2026-10-10
Medium	6.5	EPSS 0.2%	CVE-2026-81281Graphene · Cross-site Scripting Medium6.5EPSS 0.2%2026-09-03CVE Database V5CVE-2026-81281 Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions. EPSS 0.2%Vulnerability silverks #cwe-79	CVE Database V5	2026-09-03
Medium	5.3	EPSS 0.5%	CVE-2024-1984Graphene · Missing Authorization Medium5.3EPSS 0.5%2024-04-09CVE Database V5CVE-2024-1984 The Graphene theme for WordPress is vulnerable to unauthorized access of data via meta tag in all versions up to, and including, 2.9.2. This makes it possible for unauthenticated individuals to obtain post contents of password protected posts via the generated source. EPSS 0.5%Vulnerability silverks #cwe-862	CVE Database V5	2024-04-09

Showing 1–3 of 3 results