MEDIUM
averta
CVE published 2026-01-06
CVE-2025-4776
The Phlox theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption` HTML attribute in all versions up to, and including, 2.17.7 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages, which execute when a user accesses an injected page. Defen [truncated]