CVE-2026-41557: WordPress Kapee theme < 1.7.1 - Cross Site Scripting (XSS) vulnerability

Synopsis

A reflected or stored cross-site scripting (XSS) vulnerability exists in the Kapee WordPress theme by PressLayouts, affecting all versions before 1.7.1. The flaw is reachable over the network and requires no authentication, but a victim must interact with a crafted link or page for the attack to succeed. Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, enabling session theft, content manipulation, and minor disruption of the affected page. A patched-image rebuild at version 1.7.1 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target WordPress site over the network; the vulnerable theme component is exposed via standard HTTP/HTTPS.

• AuthenticationNot required

  No account or credentials are needed; the vulnerability is exploitable by any unauthenticated party who can deliver a crafted request or link to a victim.

• Victim interactionRequired

  A victim must interact with a malicious link or crafted page, making social engineering (phishing, malicious redirect) a necessary step in the attack chain.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout dependencies, or other environmental preconditions.

Blast Radius

• Reads session cookies or authentication tokens from the victim's browser if the HttpOnly flag is absent, enabling session hijacking.
• Injects and executes arbitrary JavaScript in the context of the victim's browser session on the affected WordPress site.
• Modifies visible page content for the victim, enabling phishing overlays or credential-harvesting forms.
• Causes minor disruption to the victim's browsing session on the affected site (availability impact limited to the client-side context).