CVE-2026-10077 — YOOtheme Pro < 5.0.35 - Author+ Stored XSS via UIkit Data Attributes
The yootheme WordPress theme before 5.0.35 does not prevent its bundled front-end framework from treating certain HTML attributes, which are permitted by wp_kses_post(), as mark…
Published: 2026-07-02 · CVSS: 6.8 · CVSS 3.1
The yootheme WordPress theme before 5.0.35 does not prevent its bundled front-end framework from treating certain HTML attributes, which are permitted by wp_kses_post(), as markup, allowing users with the Author role to perform Stored Cross-Site Scripting attacks that execute in the browser of any user who views the affected post.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7