CVE-2026-57397 ThimPress. CVE debrief

Who should care

Defenders responsible for managing and securing WordPress installations with the Coaching theme should assess exposure and prioritize remediation.

Why it matters

CVE-2026-57397 is a high-severity unauthenticated Cross Site Scripting (XSS) vulnerability in Coaching theme versions <= 3.9.2. Defenders should assess exposure, prioritize remediation, and verify fixes.

• Defenders must verify if the Coaching theme version is <= 3.9.2 and update to a patched version if necessary
• Potential exploitation attempts may be made against vulnerable systems
• Defenders should monitor system logs for suspicious requests

Technical summary

CVE-2026-57397 is a high-severity unauthenticated Cross Site Scripting (XSS) vulnerability in Coaching theme versions <= 3.9.2. The vulnerability has a CVSS score of 7.1 and is classified as HIGH.

Defensive priority

Defenders should prioritize verifying affected versions, applying vendor patches, and monitoring for potential exploitation attempts.

Recommended defensive actions

• Verify if the Coaching theme version is <= 3.9.2 and update to a patched version if necessary
• Monitor for potential exploitation attempts and anomalous activity
• Review system logs for suspicious requests

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation is required to determine the scope of affected systems and potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.