PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-22328 VamTam CVE debrief

CVE-2026-22328 is a high-severity Unauthenticated Cross Site Scripting (XSS) vulnerability in the Auto Repair theme, version <= 22.6. The vulnerability has a CVSS score of 7.1 and was published on 2026-06-17. Users of the affected theme should apply patches or updates as soon as available. The vulnerability allows attackers to inject malicious scripts into web pages viewed by other users. This issue requires immediate attention from administrators of websites using the Auto Repair theme. The vulnerability was reported by Patchstack and listed in the National Vulnerability Database (NVD).

Vendor
VamTam
Product
Auto Repair
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-17
Advisory published
2026-06-17
Advisory updated
2026-06-17

Who should care

Administrators and users of the Auto Repair theme version <= 22.6 should be aware of this vulnerability. Web application security teams and developers using this theme should prioritize patching or mitigating this vulnerability.

Technical summary

CVE-2026-22328 is an Unauthenticated Cross Site Scripting (XSS) vulnerability in the Auto Repair theme, affecting versions <= 22.6. The vulnerability has a CVSS score of 7.1 and a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. This vulnerability allows unauthenticated attackers to inject malicious scripts into web pages, potentially leading to user account takeovers or other malicious activities.

Defensive priority

High

Recommended defensive actions

  • Apply patches or updates for the Auto Repair theme as soon as available.
  • Review and update the Auto Repair theme to the latest version.
  • Implement Content Security Policy (CSP) to mitigate XSS attacks.
  • Monitor web application logs for suspicious activity.
  • Use a Web Application Firewall (WAF) to detect and prevent XSS attacks.
  • Educate users about the risks of XSS vulnerabilities and how to identify potential attacks.

Evidence notes

The vulnerability was reported by Patchstack and listed in the National Vulnerability Database (NVD). The CVE record and NVD detail pages provide additional information about the vulnerability.

Official resources

public