What is the CVSS score of CVE-2025-31055?

CVE-2025-31055 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-31055

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-07-16 audit@patchstack.com

WordPress XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:42 NVD

7.1 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:26 vuln.today

CVE Published

Jul 16, 2025 - 12:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vergatheme Electrician - Electrical Service WordPress electrician allows Reflected XSS.This issue affects Electrician - Electrical Service WordPress: from n/a through <= 1.0.

AnalysisAI

Reflected cross-site scripting (XSS) in vergatheme Electrician WordPress theme version 1.0 and earlier allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users through crafted URLs. The vulnerability stems from improper input neutralization during web page generation, enabling stored or reflected payload execution in victim browsers without authentication requirements.

Technical ContextAI

This is a classic reflected XSS vulnerability (CWE-79) in a WordPress theme. The vergatheme Electrician theme fails to properly sanitize or escape user-supplied input when generating HTML output. WordPress themes interact directly with PHP superglobals ($_GET, $_POST, $_REQUEST) and the WordPress templating system; if these inputs are echoed to the page without using proper escaping functions (such as esc_html(), esc_url(), or wp_kses_post()), attackers can inject arbitrary JavaScript. The vulnerability affects the theme itself rather than WordPress core, meaning all installations using this theme version are impacted regardless of WordPress version or plugin configuration.

Affected ProductsAI

vergatheme Electrician - Electrical Service WordPress theme from version n/a through version 1.0. The theme is distributed via WordPress.org plugin/theme repository and third-party theme marketplaces. Affected users have this theme installed on any WordPress site using version 1.0 or earlier.

RemediationAI

Update the vergatheme Electrician theme to a patched version newer than 1.0 if available from the theme author. If no patched version is released, disable and remove the theme from affected WordPress installations, replacing it with an alternative theme. Ensure all user input is properly escaped using WordPress security functions (esc_html(), esc_url(), sanitize_text_field()) before output. Review the theme code at https://patchstack.com/database/Wordpress/Theme/electrician/vulnerability/wordpress-electrician-electrical-service-wordpress-1-0-cross-site-scripting-xss-vulnerability for specific vulnerable parameters and implement input validation on those vectors.