CVE-2026-17025

Name of the Vulnerable Software and Affected Versions Graphene versions prior to 2.9.5

Description The Graphene theme for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated attackers with Subscriber-level access or higher can inject arbitrary web scripts through the Current location and Author profile image URL profile fields. These scripts execute automatically when a user visits the affected page.

Recommendations Update Graphene to version 2.9.5 or later.