CVE-2026-24949: 
WordPress vulnerability analysis and mitigation

CVE-2026-24949 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the ThemeGoods PhotoMe WordPress theme. It affects all versions up to and including 5.7.1, and was patched in version 5.7.2. The vulnerability was reported by João Pedro S Alcântara (Kinorth) on November 18, 2025, and published on February 3, 2026 by Patchstack, with NVD publication on February 20, 2026. It carries a CVSS v3.1 base score of 7.1 (Medium/High) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically manifesting as DOM-Based XSS. In DOM-Based XSS, malicious input is processed and rendered by the victim's browser via client-side JavaScript without adequate sanitization, rather than being reflected or stored server-side. The attack vector is network-based, requires no authentication (unauthenticated attacker), but does require user interaction — a victim must visit or interact with a crafted page or link. No public proof-of-concept exploit code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on an affected WordPress site. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, redirection to malicious sites, and defacement of web content visible to site visitors. The scope is changed (S:C in CVSS), meaning the impact extends beyond the vulnerable component itself to affect other resources such as the victim's browser session (Patchstack).

There is no confirmed evidence of active in-the-wild exploitation or inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog at this time. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. No exploit kits or weaponized code have been publicly identified. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites using the PhotoMe theme version 5.7.1 or earlier, using tools such as WPScan or passive fingerprinting via HTTP response headers and page source analysis.
2. Craft malicious payload: Construct a URL or page containing a DOM-Based XSS payload targeting the vulnerable JavaScript sink within the PhotoMe theme (e.g., a crafted URL parameter or fragment that is unsafely written to the DOM).
3. Deliver payload: Distribute the malicious link to a target user via phishing email, social engineering, or embedding in a third-party page — user interaction (clicking the link or visiting the page) is required.
4. Trigger execution: When the victim visits the crafted URL in their browser, the PhotoMe theme's client-side JavaScript processes the unsanitized input and injects it into the DOM, causing the malicious script to execute in the victim's browser context.
5. Achieve objective: The executed script can steal session cookies, capture credentials, perform actions on the WordPress site on behalf of the victim, or redirect the user to an attacker-controlled site (Patchstack).

• Network: Unusual outbound requests from victim browsers to attacker-controlled domains following visits to WordPress pages using the PhotoMe theme; suspicious URL fragments or query parameters containing encoded JavaScript payloads (e.g., <script>, javascript:, onerror=, eval().
• Logs: WordPress access logs showing requests with suspicious URL-encoded characters or script tags in query strings or URL fragments targeting PhotoMe theme pages.
• Browser/Client-Side: Unexpected JavaScript execution, redirects, or pop-ups when visiting pages powered by the PhotoMe theme; browser developer console errors related to DOM manipulation.
• File System: Unexpected modifications to theme files if an attacker escalates from XSS to further compromise (e.g., injected scripts in theme PHP or JS files) (Patchstack).

The vendor (ThemeGoods) has released a patched version: PhotoMe 5.7.2, which resolves the vulnerability. All site administrators running PhotoMe version 5.7.1 or earlier should update to 5.7.2 or later immediately. As an interim measure, Patchstack has issued a virtual patching/mitigation rule for Patchstack-protected sites to block exploitation attempts until the theme is updated. No other configuration-based workarounds have been documented (Patchstack).

The vulnerability was covered in Wordfence's weekly WordPress vulnerability report for the period of February 2–8, 2026, reflecting routine industry tracking of WordPress theme vulnerabilities. No notable individual researcher commentary or significant social media discussion has been identified beyond standard vulnerability database aggregation (Wordfence Blog).