PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-112863 Hogash CVE debrief

The CVE-2026-112863 vulnerability is a Cross Site Scripting (XSS) issue affecting the KALLYAS theme for WordPress, versions up to 4.25.0. This vulnerability is due to improper neutralization of input during web page generation, allowing for Reflected XSS attacks. Defenders should verify exposure of WordPress installations using the KALLYAS theme version 4.25.0 or earlier and assess the need for updates or mitigations. The CVE record was published on 2026-10-23T13:00:16.927Z and has not been modified since then. The source item provides details on the Cross Site Scripting (XSS) vulnerability in the KALLYAS theme for WordPress. AI-assisted PatchSiren debrief based on the supplied c源

Vendor
Hogash
Product
KALLYAS
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-23
Original CVE updated
2026-10-24
Advisory published
2026-10-23
Advisory updated
2026-10-24

Who should care

Defenders responsible for WordPress installations using the KALLYAS theme should assess exposure and prioritize verification and potential updates or mitigations.

Why it matters

CVE-2026-112863 is a Cross Site Scripting (XSS) vulnerability in the KALLYAS theme for WordPress, affecting versions up to 4.25.0. Defenders should verify exposure, assess the need for updates or mitigations, and monitor for potential XSS attacks.

  • Verification of exposure for WordPress installations using KALLYAS theme version 4.25.0 or earlier
  • Potential for XSS attacks if not mitigated
  • Need for updates or compensating controls

Technical summary

The KALLYAS theme for WordPress has a Reflected Cross Site Scripting (XSS) vulnerability affecting versions up to 4.25.0. This issue is due to improper neutralization of input during web page generation. The vulnerability allows attackers to inject malicious scripts into web pages viewed by other users. Defenders should prioritize verifying exposure of WordPress installations using the KALLYAS theme version 4.25.0 or earlier and assess the need for updates or mitigations. The vulnerability is described as a Reflected XSS issue affecting versions up to 4.25.0.

Defensive priority

Defenders should prioritize verifying exposure of WordPress installations using the KALLYAS theme version 4.25.0 or earlier and assess the need for updates or mitigations.

Recommended defensive actions

  • Verify WordPress installations for KALLYAS theme version 4.25.0 or earlier
  • Assess the need for updates or mitigations
  • Monitor for potential XSS attacks

Evidence notes

The CVE record and source item provide details on the Cross Site Scripting (XSS) vulnerability in the KALLYAS theme for WordPress. The vulnerability is described as a Reflected XSS issue affecting versions up to 4.25.0.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-112863 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-112863

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-112863 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-112863

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.