CVE-2026-93902

Name of the Vulnerable Software and Affected Versions Soledad theme for WordPress versions prior to 8.7.8

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. Attackers can inject arbitrary web scripts into social profile fields. While the payload is stored in the attacker's user meta, it is publicly exposed on the author archive page at the endpoint '/author//', allowing the script to execute when accessed by unauthenticated visitors.

Recommendations Update the Soledad theme for WordPress to version 8.7.8 or later.