CVE-2026-22328: WordPress Auto Repair theme <= 22.6 - Reflected Cross Site Scripting (XSS) vulnerability

Synopsis

Reflected cross-site scripting (XSS) in the VamTam Auto Repair WordPress theme version 22.6 and earlier allows an unauthenticated remote attacker to inject malicious scripts into a victim's browser by tricking them into visiting a crafted URL. No login or account is required to craft the attack payload; the victim only needs to click a malicious link. Successful exploitation gives the attacker the ability to read session cookies, inject content, and partially disrupt the page rendered in the victim's browser. HarborGuard is tracking this advisory for patch availability as no fix version has been published yet.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious payload over the network by crafting a URL that targets the vulnerable theme endpoint, so the service must be reachable from the internet or the attacker's network position.

• AuthenticationNot required

  No account or credentials of any kind are needed; the reflected payload can be crafted and delivered by any anonymous party.

• Victim interactionRequired

  A victim must click or otherwise navigate to the attacker-crafted URL for the malicious script to execute in their browser, making social engineering a necessary step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race conditions, or environmental configuration to trigger.

Blast Radius

• Reads browser-accessible session cookies and authentication tokens belonging to the victim, which can be replayed to impersonate the victim.
• Injects arbitrary content into the page rendered in the victim's browser, enabling phishing overlays or credential-harvesting forms.
• Modifies the visual state of the rendered page, partially disrupting the legitimate user experience.
• Executes requests on behalf of the victim against the WordPress application, potentially performing actions the victim is authorized to perform.