Bug 2548949 (CVE-2026-17025) - CVE-2026-17025 graphene: graphene: Stored Cross-Site Scripting via profile fields
Summary: CVE-2026-17025 graphene: graphene: Stored Cross-Site Scripting via profile fi...
Keywords:
Status: NEW
Alias: CVE-2026-17025
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-10 05:41 UTC by OSIDB Bzimport
Modified: 2026-10-10 05:47 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-10 05:41:53 UTC 
The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Note You need to log in before you can comment on or make changes to this bug.