CVE-2026-6646

Name of the Vulnerable Software and Affected Versions The7 theme for WordPress versions prior to 14.3.3

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on the title component of the link shortcode parameter within the 'dt default button' shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update to a version later than 14.3.2. As a temporary workaround, restrict the use of the 'dt default button' shortcode for users with Contributor-level access.