Lifecycle Timeline
2DescriptionNVD
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Invico - WordPress Consulting Business Theme invico allows Reflected XSS.This issue affects Invico - WordPress Consulting Business Theme: from n/a through <= 1.9.
AnalysisAI
Reflected cross-site scripting (XSS) vulnerability in designthemes Invico WordPress theme version 1.9 and earlier allows unauthenticated remote attackers to inject malicious scripts into web pages viewed by other users. The vulnerability stems from improper input neutralization during web page generation, enabling attackers to steal session tokens, perform unauthorized actions, or redirect users to malicious sites by crafting specially crafted URLs. No CVSS score has been assigned, but the EPSS exploitation probability is very low at 0.04% (13th percentile), and no public exploit code or active exploitation has been confirmed at time of analysis.
Technical ContextAI
This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a widespread class of client-side injection flaws. The Invico theme, a WordPress consulting business theme by designthemes, fails to properly sanitize or escape user-supplied input before rendering it in HTML responses. Reflected XSS occurs when untrusted data (typically from URL query parameters or form inputs) is directly included in the HTTP response without encoding, allowing browser JavaScript execution in the context of the vulnerable site. The vulnerability affects the theme layer rather than WordPress core, making it specific to installations using Invico version 1.9 or earlier.
Affected ProductsAI
The vulnerability affects designthemes Invico WordPress Consulting Business Theme in version 1.9 and all earlier releases (CPE data for WordPress themes typically follows wp-theme-[vendor]-[slug], in this case related to invico theme). The theme is distributed through the WordPress theme directory and third-party marketplaces. Affected installations include any WordPress site actively using Invico theme at version 1.9 or below.
RemediationAI
Update the Invico theme to the patched version released by designthemes. Users should navigate to WordPress Dashboard → Appearance → Themes, locate Invico, and click the update button if a newer version is available; if no update is shown, verify the theme is no longer abandoned by checking the official theme repository or designthemes website. The vulnerability report is documented at https://patchstack.com/database/Wordpress/Theme/invico/vulnerability/wordpress-invico-wordpress-consulting-business-theme-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve, which may contain version information for the patched release. As an interim measure, administrators can restrict URL parameter inputs and enable WordPress security headers such as Content-Security-Policy to mitigate XSS impact, though theme patching is the definitive remediation.
Share
External POC / Exploit Code
Leaving vuln.today