EUVD-2025-19977Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs Pressroom - News Magazine WordPress Theme allows Reflected XSS. This issue affects Pressroom - News Magazine WordPress Theme: from n/a through 6.9.
AnalysisAI
We need to produce a comprehensive analysis in JSON. The CVE is about a Reflected XSS in a WordPress theme "Pressroom - News Magazine WordPress Theme" up to version 6.9. We have multiple sources: EPSS low, no KEV, no explicit POC mentioned (none in input). The vulnerability is reported by Patchstack, so likely they have details. Need to synthesize.
Let's fill each field:
- product_name: The specific product name in 1-3 words. "Pressroom Theme" (since it's a WordPress theme, maybe "Pressroom WordPress Theme" or just "Pressroom"? Brief: "Pressroom Theme" but "Pressroom - News Magazine WordPress Theme" is the full name. The EUVD says: "Pressroom - News Magazine WordPress Theme n/a ≤6.9". So I'll use "Pressroom Theme". Keep it concise: "Pressroom WordPress Theme" (3 words). The vulnerability is in the theme, so product name: "Pressroom Theme".
- summary: 2-3 sentences, original synthesis, not copy description. Start with impact verb and product. "Reflected cross-site scripting in the Pressroom WordPress theme through version 6.9 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser via a crafted URL." Mention affected product (theme, versions). Note that exploitation requires user interaction (UI:R in CVSS vector). Actively exploited? No KEV, no POC mentioned. EPSS low 0.03%, so not high. So summary: "Reflected cross-site scripting in the Pressroom WordPress theme through version 6.9 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser when they click a malicious link. Successful exploitation could lead to session hijacking, defacement, or sensitive data exposure." Not exploited actively, no known POC.
- technical_context: Underlying technology: WordPress theme, PHP, reflected XSS due to improper output escaping (CWE-79). CVE description says "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" so reflected XSS. CWE-79. The affected product is a WordPress theme. How
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today