Overview
CVE-2026-28154 is a high-severity reflected cross-site scripting (XSS) vulnerability affecting two WooCommerce WordPress themes developed by snstheme: the Samex – Clean, Minimal Shop theme and the M.Anh – Fashion WooCommerce theme. The flaw stems from improper neutralization of input during web page generation, allowing an attacker to inject arbitrary JavaScript into pages viewed by unsuspecting users.
The vulnerability was published to the National Vulnerability Database (NVD) on August 13, 2026, and carries a CVSS score of 7.1 (High).
Technical Details
Reflected XSS occurs when user-supplied input is returned by a web application in an HTTP response without proper sanitization or encoding. In this case, the affected themes fail to adequately filter or escape user-controlled parameters before reflecting them back in HTML output. An attacker can craft a malicious URL containing JavaScript payload, then trick a victim into clicking the link — causing the script to execute in the victim's browser within the security context of the vulnerable WordPress site.
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
CVSS Score: 7.1 (High)
Potential impacts include:
- Session hijacking — stealing authentication cookies to take over logged-in accounts (including administrator sessions)
- Credential phishing — injecting fake login forms to harvest credentials
- Malicious redirects — sending users to attacker-controlled sites
- Defacement or drive-by malware delivery via injected scripts
Affected Products
| Theme | Vendor |
|---|---|
| Samex – Clean, Minimal Shop WooCommerce WordPress Theme | snstheme |
| M.Anh – Fashion WooCommerce WordPress Theme | snstheme |
All versions up to the patch are considered affected. Consult the theme vendor and the NVD advisory for exact version ranges.
Remediation
- Update immediately — apply the latest patched version of the affected theme from the vendor or the WordPress theme marketplace.
- Audit active themes — review any other snstheme products in use for similar input-handling issues.
- Enable a WAF rule — a web application firewall (e.g., Wordfence, Cloudflare WAF) can add a layer of defence against reflected XSS attempts while a patch is applied.
- Restrict access to staging sites — limit public exposure of WordPress sites running unpatched themes.
- Monitor for exploitation indicators — watch server access logs for URL patterns containing
<script>tags,javascript:URIs, or encoded equivalents.