CVE-2026-78289

WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions.

We have discovered 11 live websites that are affected by CVE-2026-78289.

Run a Free Instant Scan



Affected Software

Product  CozyStay
Category Wordpress Themes
Vulnerable Domains11 live websites (1.89% of CozyStay install base)
Vulnerable Versions
  • from 0 through 1.10
Vulnerable Versions Count1 versions ( 17% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Aug 27, 2026
  • Updated - Aug 27, 2026

Credits

  • G0053 | Patchstack Bug Bounty Program (finder)

Website Distribution by Country

Number of websites using CVE-2026-78289
United States2 websites


GB2 websites
Italy2 websites
Greece1 websites
Malaysia1 websites
Slovenia1 websites
Ukraine1 websites
Vietnam1 websites

Website Distribution by TLD

Number of websites using CVE-2026-78289
.com6 websites
.info1 websites
.it1 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-78289

Top websites that are affected by CVE-2026-78289. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
************.vn Vietnam*,***,***
***********.info Ukraine**,***,***
************.com United States**,***,***
*******.gr Greece**,***,***
****************.com United States**,***,***
*********.it Italy**,***,***
**********************.com GB**,***,***
******************.com Malaysia**,***,***
********.com Italy**,***,***
*********.si Slovenia**,***,***
See full domain list

FAQ

CVE-2026-78289 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in CozyStay
A total of 11 websites have been identified as vulnerable to CVE-2026-78289, based on global website indexing conducted by WebTechSurvey.
The CozyStay is affected by the CVE-2026-78289 vulnerability.
CozyStay versions up to and including 1.10 are vulnerable to CVE-2026-78289.