The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pcsml_smartlists_h’ parameter in all versions up to, and including, 8.6.7 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts into pages. These scripts will execute whenever a user accesses an injected page.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.4 | CVE-2025-8143 |
Exploitation
To exploit this vulnerability, an attacker with Contributor-level access can craft a malicious payload and submit it through the ‘pcsml_smartlists_h’ parameter. Once injected, the script will execute in the context of users who access the affected pages, potentially leading to data theft or session hijacking.
Affected Products
- Soledad Theme (versions up to 8.6.7): A popular WordPress theme that allows users to create blogs and magazines, which is susceptible to XSS attacks due to improper input handling.
Mitigation
To mitigate this vulnerability, users should update the Soledad theme to the latest version where the issue has been addressed. Additionally, implementing proper input validation and output escaping practices can help prevent similar vulnerabilities in the future.