CVE-2026-22465
Published: 05 March 2026
Summary
CVE-2026-22465 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-22465 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS), in the SeventhQueen BuddyApp theme for WordPress. The issue affects BuddyApp versions from unknown starting point through 1.9.2. It carries a CVSS v3.1 base score of 7.1, with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network accessibility, low attack complexity, no required privileges, user interaction needed, changed scope, and low impacts across confidentiality, integrity, and availability.
Attackers can exploit this vulnerability remotely without authentication by crafting malicious payloads delivered via reflected inputs on web pages generated by the affected theme. Exploitation requires a user, such as an administrator or logged-in visitor, to interact by clicking a specially crafted link or visiting a malicious site, enabling execution of arbitrary JavaScript in the victim's browser context. This could lead to session hijacking, data theft, or further compromise within the scope of the user's privileges.
Patchstack's advisory at https://patchstack.com/database/Wordpress/Theme/buddyapp/vulnerability/wordpress-buddyapp-theme-1-9-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve provides details on the vulnerability in the BuddyApp theme version 1.9.2, recommending updates to patched versions where available or other mitigations like input sanitization.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9581
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeventhQueen BuddyApp buddyapp allows Reflected XSS.This issue affects BuddyApp: from n/a through <= 1.9.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress theme directly enables remote exploitation of web app (T1190) and arbitrary JavaScript execution in browser (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of untrusted web inputs before they are used in page generation, blocking the reflected XSS payloads that exploit improper neutralization in BuddyApp.
Requires filtering or encoding of information in outputs, which would mitigate execution of attacker-supplied scripts in the reflected XSS response returned to the victim's browser.
Provides malicious-code detection and blocking mechanisms that can identify or prevent execution of injected JavaScript delivered via the crafted reflected-XSS links.