CVE-2025-5529

MEDIUM

2025-07-26 [email protected]

WordPress XSS

6.4

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

CVE Published

Jul 26, 2025 - 08:15 nvd

MEDIUM 6.4

DescriptionNVD

The Educenter theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Circle Counter Block in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Educenter WordPress theme Circle Counter Block allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript into pages, executing when users visit affected content. The vulnerability stems from insufficient input sanitization in the circle-counter.php block component (versions up to 1.6.2) and affects all users viewing injected pages. CVSS 6.4 (medium) reflects the requirement for authenticated access and limited scope; no public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

The vulnerability exists in the Educenter theme's Circle Counter Block, a custom WordPress block component located in blocks-extends/blocks/circle-counter.php. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation) - the block fails to properly sanitize user-supplied input before storing it in the database and does not adequately escape output when rendering the block content. WordPress themes can extend block functionality through custom PHP; this theme's implementation neglects WordPress security functions like sanitize_text_field() at input time and esc_html(), esc_attr(), or wp_kses_post() at output time. The vulnerability is Stored (Persistent) XSS because the malicious payload persists in the database and executes for all users, not just the attacker.

Affected ProductsAI

Educenter WordPress theme in all versions up to and including 1.6.2 (CPE: wp-theme-educenter). The vulnerability specifically affects the Circle Counter Block component within the theme. WordPress installations using Educenter theme versions 1.6.2 or earlier with active contributors or higher-privileged user accounts are in scope.

RemediationAI

Educenter theme maintainers have released patch updates to version 1.6.3 and above. Site administrators should immediately update the Educenter theme to version 1.6.3 or later via the WordPress admin dashboard (Appearance → Themes → Updates) or directly from the WordPress theme repository. As an interim measure before patching, restrict Contributor-level account creation and audit existing contributors for suspicious activity; use WordPress role management plugins to limit contributor permissions if necessary. Review the circle-counter block usage across published pages and revise any content modified by untrusted users. Refer to the Wordfence threat intelligence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/6f524163-4d4c-40fc-b58a-311f1f6cac15?source=cve) for detailed remediation guidance.

CVE-2025-5529 vulnerability details – vuln.today

Back