What is the CVSS score of CVE-2025-53301?

CVE-2025-53301 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Theme Junkie Team Content CVE-2025-53301

EUVD-2025-19366 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-06-27 audit@patchstack.com

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Requires contributor-level auth (PR:L) and victim page view (UI:R); scope changes to victim session; no availability impact for XSS.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 00:16 euvd

EUVD-2025-19366

Analysis Generated

Mar 16, 2026 - 00:16 vuln.today

CVE Published

Jun 27, 2025 - 14:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme Junkie Theme Junkie Team Content allows DOM-Based XSS. This issue affects Theme Junkie Team Content: from n/a through 0.1.1.

AnalysisAI

DOM-Based Cross-Site Scripting in the Theme Junkie Team Content WordPress plugin (versions through 0.1.1) allows a low-privileged authenticated attacker to inject malicious scripts that execute in the browser of any user who views the affected page. Because the scope changes (S:C in the CVSS vector), the injected script can access session cookies and perform actions on behalf of higher-privileged users such as administrators. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.04% reflects very low observed exploitation probability.

Technical ContextAI

The affected component is the Theme Junkie Team Content plugin for WordPress, a team/staff display plugin, versions up to and including 0.1.1. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the DOM-Based variant, meaning unsanitized attacker-controlled input is written directly into the DOM via JavaScript rather than being reflected or stored in server-rendered HTML. This is common in WordPress plugins that use JavaScript to render shortcode or widget output client-side without encoding user-supplied values before insertion into innerHTML or similar sinks. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C confirms the vulnerability is network-reachable, requires low privileges (contributor-level WordPress account to inject) and user interaction (a victim must load the page), and has scope change indicating cross-session impact.

RemediationAI

No patched version is identified in the available data - the advisory covers versions through 0.1.1 with no confirmed fix release. Site owners should check the WordPress plugin repository for an updated version of Theme Junkie Team Content above 0.1.1 and upgrade immediately if available. If no update exists, the immediate compensating control is to deactivate and remove the plugin. As a secondary control, restrict WordPress contributor and author role assignments to fully trusted users only, reducing the pool of accounts that could inject malicious input. Do not rely on WAF-based XSS filtering alone for DOM-Based XSS, as server-side WAFs typically cannot inspect client-side DOM manipulation. Monitor the Patchstack advisory page for patch availability.