What is the CVSS score of CVE-2025-52739?

CVE-2025-52739 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Sala WordPress theme are affected by CVE-2025-52739?

The Sala WordPress theme (versions 1.1.3 and earlier) contains a reflected cross-site scripting vulnerability (CVE-2025-52739) with CVSS 7.1 severity.

How to fix or mitigate CVE-2025-52739?

Within 24 hours, identify all WordPress sites running Sala theme through version 1.1.3 using site inventory and admin dashboards; simultaneously implement WAF rules to block reflected XSS payloads targeting the vulnerable theme parameters. Within 7 days, contact Sala theme vendor regarding patch availability and timeline, subscribe to official security notifications, and evaluate replacement WordPress themes. Within 30 days, complete migration of affected sites to patched or alternative themes and deploy Content Security Policy headers site-wide to provide defense-in-depth against script injection.

Sala WordPress theme CVE-2025-52739

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-12-31 audit@patchstack.com

WordPress XSS Wordpress Theme

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable reflected XSS needing victim click (UI:R), unauthenticated attacker (PR:N); scope change and low C/I/A retained consistent with browser-context script execution.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 08:31 vuln.today

CVE Published

Dec 31, 2025 - 20:15 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Sala sala allows Reflected XSS.This issue affects Sala: from n/a through <= 1.1.3.

AnalysisAI

Reflected cross-site scripting in the uxper Sala WordPress theme (all versions through 1.1.3) allows remote attackers to inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Reported by Patchstack, the flaw carries a CVSS 7.1 score driven largely by a scope change, though there is no public exploit identified at time of analysis and the EPSS score is very low (0.04%, 14th percentile), indicating minimal current mass-exploitation activity.

Technical ContextAI

Sala is a commercial WordPress theme distributed by the vendor uxper, used to build front-end presentation for WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input is reflected back into an HTML response without proper output encoding or contextual sanitization. Because this is a reflected variant, the malicious payload is delivered within the request (typically a URL parameter) and echoed into the generated page, rather than being stored server-side. The CVSS scope-change flag (S:C) suggests the injected script executes in a security context beyond the vulnerable component itself - consistent with browser-side script running against the authenticated WordPress session of whoever visits the crafted link.

Affected ProductsAI

The affected product is the Sala WordPress theme by uxper, versions from an unspecified starting point through and including 1.1.3 (n/a through <= 1.1.3). No CPE string was provided in the source data. The authoritative advisory is the Patchstack database entry at https://patchstack.com/database/wordpress/theme/sala/vulnerability/wordpress-sala-theme-1-1-3-cross-site-scripting-xss-vulnerability, which is referenced by NVD.

RemediationAI

No fixed version is stated in the available data - the advisory only confirms vulnerability through 1.1.3 - so treat this as No vendor-released patch version independently confirmed at time of analysis and check the Patchstack advisory (https://patchstack.com/database/wordpress/theme/sala/vulnerability/wordpress-sala-theme-1-1-3-cross-site-scripting-xss-vulnerability) and the uxper vendor page for a release later than 1.1.3, upgrading as soon as one is published. As compensating controls until a patched release is applied, deploy a WAF or the Patchstack virtual-patching capability to filter reflected XSS payloads in request parameters (trade-off: rule tuning may cause false positives), restrict or monitor access to the affected theme's request endpoints, and set a restrictive Content-Security-Policy header to limit inline/injected script execution (trade-off: an overly strict CSP can break legitimate theme JavaScript and require testing). Educating administrators and editors not to click untrusted links reduces the practical likelihood given the required user interaction.