CVE-2026-112863
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The KALLYAS WordPress theme (Hogash) in versions up to 4.25.0 contains a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. An attacker can trick a user into clicking a crafted link, leading to execution of malicious script in the victim's browser.
Risk Assessment
Potential execution of arbitrary script in the user's browser context, which may lead to session or data theft.
Recommendation
Update the KALLYAS theme to a version later than 4.25.0, which contains the fix for this issue.
Other vulnerabilities in KALLYAS
See all- CVE-2025-63061Medium
The KALLYAS theme (versions below 4.25.0) contains a DOM-Based Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. A malicious script can be executed in the user's browser through DOM manipulation.
- CVE-2025-63060Medium
The KALLYAS plugin (by hogash) is vulnerable to Cross-Site Request Forgery (CSRF). This issue affects KALLYAS versions from n/a through < 4.25.0.
- CVE-2025-62018Medium
Missing Authorization vulnerability in hogash KALLYAS kallyas. This issue affects KALLYAS from n/a through <= 4.22.0.
- CVE-2025-62017Medium
The KALLYAS theme for WordPress is vulnerable to missing authorization in versions up to and including 4.22.0. This vulnerability may allow unauthorized access to functions or data.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS: from n/a through 4.25.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS