What is the CVSS score of CVE-2025-31072?

CVE-2025-31072 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-31072

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-07-16 audit@patchstack.com

WordPress XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:42 NVD

7.1 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:26 vuln.today

CVE Published

Jul 16, 2025 - 12:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Ofiz - WordPress Business Consulting Theme ofiz allows Reflected XSS.This issue affects Ofiz - WordPress Business Consulting Theme: from n/a through <= 2.0.

AnalysisAI

Reflected cross-site scripting (XSS) in the Ofiz WordPress Business Consulting Theme through version 2.0 allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users. The vulnerability stems from improper input neutralization during web page generation, enabling attackers to craft malicious URLs that execute arbitrary JavaScript in victims' browsers when clicked. No public exploit code or active exploitation has been confirmed; the low EPSS score (0.04%) suggests limited real-world attack probability despite the vector's potential for user interaction.

Technical ContextAI

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), which describes insufficient output encoding or input validation in web applications. The Ofiz theme, a WordPress plugin for business consulting websites, fails to properly sanitize or escape user-supplied input before rendering it in HTTP responses. Reflected XSS vulnerabilities typically occur when user input from query parameters, form fields, or other request data is directly echoed back to the client without encoding HTML special characters, allowing attackers to break out of the intended data context and inject script tags. WordPress theme vulnerabilities are particularly impactful because themes are active on public-facing pages and process untrusted input from visitors.

Affected ProductsAI

The Ofiz - WordPress Business Consulting Theme by designthemes is affected in all versions from an unspecified baseline through version 2.0 (inclusive). The theme is distributed via the WordPress.org plugin/theme repository and used on WordPress websites offering business consulting services. CPE specifics for WordPress themes are not standardized in the provided data, but the vendor (Patchstack) database entry serves as the authoritative source for affected version range.

RemediationAI

Users should upgrade the Ofiz theme to a version newer than 2.0 as soon as a patch release is available from designthemes. Until an update is released, website administrators should disable or remove the theme if a patched version is not immediately available, or apply input validation rules at the WordPress level if feasible. Check the Patchstack database entry (https://patchstack.com/database/Wordpress/Theme/ofiz/vulnerability/wordpress-ofiz-wordpress-business-consulting-theme-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve) for the most current patch status and version information. WordPress site owners can also implement Web Application Firewall (WAF) rules to filter common XSS payloads as a temporary mitigation.