What is the CVSS score of CVE-2025-31054?

CVE-2025-31054 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Bloggie are affected by CVE-2025-31054?

Organizations using the Themefy Bloggie WordPress theme through version 2.0.8 face a high-severity cross-site scripting flaw that bypasses anti-CSRF defenses to inject malicious scripts into…

How to fix or mitigate CVE-2025-31054?

Within 24 hours, scan all WordPress installations to enumerate instances of Themefy Bloggie theme version 2.0.8 and earlier. Within 7 days, activate interim controls: deploy Web Application Firewall rules to block reflected XSS patterns, enforce Content Security Policy headers restricting script execution to trusted origins, and configure SameSite=Strict attributes on session cookies to prevent CSRF token bypass. Within 30 days, monitor Themefy security advisories for patch availability; if no update is released within 30 days, execute migration to an alternative WordPress theme with active security maintenance.

Bloggie CVE-2025-31054

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-12-31 audit@patchstack.com

WordPress XSS CSRF Wordpress Theme

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Remote CSRF-to-reflected-XSS delivered via link requires no attacker auth (PR:N) but victim interaction (UI:R); scope changes to the browser (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 08:31 vuln.today

CVE Published

Dec 31, 2025 - 20:15 cve.org

HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Themefy Bloggie bloggie allows Reflected XSS.This issue affects Bloggie: from n/a through <= 2.0.8.

AnalysisAI

Reflected cross-site scripting via CSRF in the Themefy Bloggie WordPress theme (all versions through 2.0.8) lets a remote attacker execute arbitrary script in a victim's browser session by tricking an authenticated user into clicking a crafted link or visiting a malicious page. Because the CSRF weakness lets the request be forged without a valid anti-CSRF token, no attacker authentication is required, though victim interaction is. There is no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.02% (5th percentile).

Technical ContextAI

Bloggie is a commercial WordPress blogging theme distributed by Themefy and tracked in the Patchstack vulnerability database. The root cause is CWE-352 (Cross-Site Request Forgery): a theme-handled request lacks proper nonce/anti-CSRF validation, so an off-site page can force a logged-in user's browser to submit a request. That forged request reflects attacker-controlled input back into a response without adequate output encoding, producing reflected XSS. The chaining of CSRF into reflected XSS is characteristic of WordPress theme/plugin handlers that echo parameters into admin or front-end pages while relying on cookie-based session auth but omitting nonce checks.

Affected ProductsAI

The affected product is the Themefy Bloggie theme for WordPress, with all versions from an unspecified starting point through and including 2.0.8 affected (the fixed/introducing version boundary below 2.0.8 is listed as n/a by the source). No CPE string was supplied in the input. The vulnerability is catalogued in the Patchstack database at https://patchstack.com/database/wordpress/theme/bloggie/vulnerability/wordpress-bloggie-2-0-8-cross-site-scripting-xss-vulnerability?_s_id=cve, which serves as the vendor/coordinator advisory reference.

RemediationAI

Upgrade Bloggie to a release later than 2.0.8; the input does not specify an exact fixed version, so treat this as 'Patch available per vendor advisory' and confirm the patched build via the Themefy/Patchstack advisory at https://patchstack.com/database/wordpress/theme/bloggie/vulnerability/wordpress-bloggie-2-0-8-cross-site-scripting-xss-vulnerability?_s_id=cve before deploying. If an updated theme cannot be applied immediately, deploy a Web Application Firewall or Patchstack virtual patch to block reflected XSS payloads and enforce request-origin/nonce checks, restrict access to the affected theme endpoints, and instruct privileged users to avoid clicking untrusted links while logged in (trade-off: WAF rules can generate false positives and do not fix the missing nonce, and user-behavior controls are unreliable). Because the flaw is CSRF-driven, ensuring administrators log out of active sessions when not in use reduces the window in which a forged request can succeed.