CVE-2026-24391
Published: 25 March 2026
Summary
CVE-2026-24391 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-24391 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as CWE-79 (Cross-site Scripting), specifically enabling Reflected XSS in the ThemeMakers Car Dealer WordPress theme (cardealer). This issue affects all versions of the Car Dealer theme up to and including 1.6.7. The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges, and scope change despite requiring user interaction.
Attackers can exploit this vulnerability remotely over the network without authentication by crafting malicious payloads delivered via reflected inputs on affected Car Dealer theme pages. Exploitation requires tricking a user (typically an authenticated site visitor or admin) into interacting with the payload, such as clicking a malicious link. Successful exploitation allows limited impacts: low confidentiality (e.g., potential theft of session data), low integrity (e.g., minor page manipulation), and low availability disruption, but with changed scope that may affect the site's security context for the victim user.
The Patchstack advisory provides details on this vulnerability in the WordPress Car Dealer theme version 1.6.7, recommending updates to patched versions where available or other mitigation steps such as input sanitization; full mitigation guidance is available at https://patchstack.com/database/Wordpress/Theme/cardealer/vulnerability/wordpress-car-dealer-theme-1-6-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15575
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeMakers Car Dealer cardealer allows Reflected XSS.This issue affects Car Dealer: from n/a through <= 1.6.7.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress theme directly enables exploitation of a web application vulnerability (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-15 directly addresses improper neutralization of input during web page generation by requiring filtering of information outputs to prevent reflected XSS script injection.
SI-10 mitigates reflected XSS by validating and sanitizing user inputs before they are reflected in web pages, blocking malicious payloads.
SI-2 ensures timely flaw remediation through patching the vulnerable Car Dealer WordPress theme, eliminating the XSS vulnerability as recommended by Patchstack.