CVE-2026-22329: WordPress Skillate theme <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerability

Synopsis

Reflected Cross-Site Scripting (XSS) affects the WordPress Skillate theme by Themeum at version 1.2.10 and below. The vulnerability is reachable over the network with no authentication required, but an attacker must trick a victim into clicking a crafted link. Successful exploitation lets an attacker execute arbitrary JavaScript in the victim's browser, enabling session hijacking, page content manipulation, or redirecting the user to a malicious site. No upstream fix has been published yet; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected WordPress site over the network and deliver a crafted URL to a victim.

• AuthenticationNot required

  No account or session credential of any kind is needed to craft the malicious payload.

• Victim interactionRequired

  The victim must click or follow a specially crafted link, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the attacker delivers the link; no race conditions or special environmental state are required.

Blast Radius

• A successful attacker executes arbitrary JavaScript in the victim's browser session on the affected WordPress site.
• The attacker can read the victim's session cookies or authentication tokens and replay them to take over the account.
• The attacker can rewrite visible page content to phish credentials or redirect the victim to an external malicious site.
• Integrity and limited availability of the page are affected, as injected scripts can alter UI state or trigger repeated error conditions for the targeted user.