CVE-2026-6646

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dt_default_button' shortcode in all versions up to, and including, 14.3.2. This is due to insufficient input sanitization and output escaping on the 'title' component of the 'link' shortcode parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 15, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-664606.5Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions.CVE-2026-664617.5Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.CVE-2026-664627.5Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions.CVE-2026-664637.5Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions.CVE-2026-664646.5Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions.CVE-2026-664659.8Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.CVE-2026-664667.5Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, SideCVE-2026-664676.5Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions.CVE-2026-664687.1Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.CVE-2026-664697.5Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions.CVE-2026-664707.1Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions.CVE-2026-664716.5Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions.
CVE-2026-6646: Medium severity, CVSS 6.4 | Vulnix