🔐 CVE Alert

CVE-2026-8423

MEDIUM 4.3

JaviBola Custom Theme Test <= 2.0.5 - Cross-Site Request Forgery

CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
3th

The JaviBola Custom Theme Test plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.5. This is due to missing or incorrect nonce validation on the options page. This makes it possible for unauthenticated attackers to change the site's active theme by modifying the jbct_theme option via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CWE CWE-352
Vendor javibola
Product javibola custom theme test
Published May 20, 2026
Last Updated May 20, 2026
Stay Ahead of the Next One

Get instant alerts for javibola javibola custom theme test

Be the first to know when new medium vulnerabilities affecting javibola javibola custom theme test are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability

Affected Versions

javibola / JaviBola Custom Theme Test
0 ≤ 2.0.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/68a8a277-2ea6-4d75-b8cd-4d20eb17b3aa?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/javibola-custom-theme/trunk/javibola-custom-theme.php#L41 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/javibola-custom-theme/tags/2.0.5/javibola-custom-theme.php#L41 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/javibola-custom-theme/trunk/javibola-custom-theme.php#L40 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/javibola-custom-theme/tags/2.0.5/javibola-custom-theme.php#L40 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/javibola-custom-theme/trunk/javibola-custom-theme.php#L54 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/javibola-custom-theme/tags/2.0.5/javibola-custom-theme.php#L54

Credits

Muhammad Nur Ibnu Hubab