CVE-2026-102393
MediumCVSS 6.5Summary
The Starter Templates plugin (astra-sites) up to version 4.7.7 has a stored Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation.
Risk Assessment
An attacker can inject malicious scripts that execute in the browser of an administrator or user, potentially leading to session theft, account takeover, or malware propagation.
Recommendation
Update the Starter Templates plugin to the latest version that includes security fixes. Additionally, implement security measures such as Content Security Policy (CSP).
Other vulnerabilities in Starter Templates
See all- CVE-2026-39721Medium
A Missing Authorization vulnerability in Brainstorm Force Starter Templates astra-sites allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Starter Templates from n/a through 4.7.7.
- CVE-2026-62134Medium
The Starter Templates plugin in versions up to and including 4.7.5 contains an Insecure Direct Object References (IDOR) vulnerability. A user with the Contributor role can access objects they should not have permission to.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Starter Templates astra-sites allows Stored XSS.This issue affects Starter Templates: from n/a through 4.7.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS