What is the CVSS score of CVE-2025-31427?

CVE-2025-31427 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-31427

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-07-16 audit@patchstack.com

WordPress XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:42 NVD

7.1 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:26 vuln.today

CVE Published

Jul 16, 2025 - 12:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Invico - WordPress Consulting Business Theme invico allows Reflected XSS.This issue affects Invico - WordPress Consulting Business Theme: from n/a through <= 1.9.

AnalysisAI

Reflected cross-site scripting (XSS) vulnerability in designthemes Invico WordPress theme version 1.9 and earlier allows unauthenticated remote attackers to inject malicious scripts into web pages viewed by other users. The vulnerability stems from improper input neutralization during web page generation, enabling attackers to steal session tokens, perform unauthorized actions, or redirect users to malicious sites by crafting specially crafted URLs. No CVSS score has been assigned, but the EPSS exploitation probability is very low at 0.04% (13th percentile), and no public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a widespread class of client-side injection flaws. The Invico theme, a WordPress consulting business theme by designthemes, fails to properly sanitize or escape user-supplied input before rendering it in HTML responses. Reflected XSS occurs when untrusted data (typically from URL query parameters or form inputs) is directly included in the HTTP response without encoding, allowing browser JavaScript execution in the context of the vulnerable site. The vulnerability affects the theme layer rather than WordPress core, making it specific to installations using Invico version 1.9 or earlier.

Affected ProductsAI

The vulnerability affects designthemes Invico WordPress Consulting Business Theme in version 1.9 and all earlier releases (CPE data for WordPress themes typically follows wp-theme-[vendor]-[slug], in this case related to invico theme). The theme is distributed through the WordPress theme directory and third-party marketplaces. Affected installations include any WordPress site actively using Invico theme at version 1.9 or below.

RemediationAI

Update the Invico theme to the patched version released by designthemes. Users should navigate to WordPress Dashboard → Appearance → Themes, locate Invico, and click the update button if a newer version is available; if no update is shown, verify the theme is no longer abandoned by checking the official theme repository or designthemes website. The vulnerability report is documented at https://patchstack.com/database/Wordpress/Theme/invico/vulnerability/wordpress-invico-wordpress-consulting-business-theme-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve, which may contain version information for the patched release. As an interim measure, administrators can restrict URL parameter inputs and enable WordPress security headers such as Content-Security-Policy to mitigate XSS impact, though theme patching is the definitive remediation.