What is the CVSS score of CVE-2025-31067?

CVE-2025-31067 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Seven Stars are affected by CVE-2025-31067?

CVE-2025-31067 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 7.1.

How to fix or mitigate CVE-2025-31067?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

Seven Stars CVE-2025-31067

EUVD-2025-19276 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-06-27 audit@patchstack.com

WordPress XSS Wordpress Theme

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Stored XSS requires no authentication for injection but victim must view page; scope changed as script runs in browser context.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:R/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 00:16 euvd

EUVD-2025-19276

Analysis Generated

Mar 16, 2026 - 00:16 vuln.today

CVE Published

Jun 27, 2025 - 12:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeton Seven Stars allows Stored XSS. This issue affects Seven Stars: from n/a through 1.4.4.

AnalysisAI

Stored cross-site scripting in the Seven Stars WordPress theme by themeton allows unauthenticated attackers to inject malicious scripts into the site that execute when other users-such as admins-view the affected page. The vulnerability affects versions 1.4.4 and earlier, and while no active exploitation has been confirmed, publicly available proof-of-concept exploits likely exist given the nature of stored XSS. CVSS 7.1 indicates high severity, but EPSS estimates only a 0.04% probability of exploitation.

Technical ContextAI

The vulnerability resides in the WordPress theme Seven Stars (CWE-79). The theme fails to properly sanitize user-supplied input before including it in generated web pages, enabling persistent cross-site scripting. Affected products are identified via Common Platform Enumeration (CPE) strings derived from the advisory, covering the WordPress theme from unknown initial version through 1.4.4. The root cause is insufficient output encoding, allowing stored XSS payloads to be embedded in the database and later served to unsuspecting users. This is a classic WordPress theme vulnerability where a theme's handling of dynamic content, such as comments or custom fields, lacks proper escaping.

RemediationAI

Immediately update the Seven Stars theme to a version newer than 1.4.4. The Patchstack advisory likely specifies an exact patched version; if not, the latest available version should be applied. No specific workarounds are detailed, but as a temporary measure, site administrators could disable user-submitted content features (e.g., comments, reviews) that the theme renders without escaping, though this may degrade site interactivity. Alternatively, a Web Application Firewall (WAF) rule to block suspicious script tags can provide some protection until the update is completed. After updating, clear all caches and review any stored content for potential malicious payloads.