Lifecycle Timeline
2DescriptionNVD
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Ofiz - WordPress Business Consulting Theme ofiz allows Reflected XSS.This issue affects Ofiz - WordPress Business Consulting Theme: from n/a through <= 2.0.
AnalysisAI
Reflected cross-site scripting (XSS) in the Ofiz WordPress Business Consulting Theme through version 2.0 allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users. The vulnerability stems from improper input neutralization during web page generation, enabling attackers to craft malicious URLs that execute arbitrary JavaScript in victims' browsers when clicked. No public exploit code or active exploitation has been confirmed; the low EPSS score (0.04%) suggests limited real-world attack probability despite the vector's potential for user interaction.
Technical ContextAI
The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), which describes insufficient output encoding or input validation in web applications. The Ofiz theme, a WordPress plugin for business consulting websites, fails to properly sanitize or escape user-supplied input before rendering it in HTTP responses. Reflected XSS vulnerabilities typically occur when user input from query parameters, form fields, or other request data is directly echoed back to the client without encoding HTML special characters, allowing attackers to break out of the intended data context and inject script tags. WordPress theme vulnerabilities are particularly impactful because themes are active on public-facing pages and process untrusted input from visitors.
Affected ProductsAI
The Ofiz - WordPress Business Consulting Theme by designthemes is affected in all versions from an unspecified baseline through version 2.0 (inclusive). The theme is distributed via the WordPress.org plugin/theme repository and used on WordPress websites offering business consulting services. CPE specifics for WordPress themes are not standardized in the provided data, but the vendor (Patchstack) database entry serves as the authoritative source for affected version range.
RemediationAI
Users should upgrade the Ofiz theme to a version newer than 2.0 as soon as a patch release is available from designthemes. Until an update is released, website administrators should disable or remove the theme if a patched version is not immediately available, or apply input validation rules at the WordPress level if feasible. Check the Patchstack database entry (https://patchstack.com/database/Wordpress/Theme/ofiz/vulnerability/wordpress-ofiz-wordpress-business-consulting-theme-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve) for the most current patch status and version information. WordPress site owners can also implement Web Application Firewall (WAF) rules to filter common XSS payloads as a temporary mitigation.
Share
External POC / Exploit Code
Leaving vuln.today