What is the CVSS score of CVE-2025-58920?

CVE-2025-58920 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Cerato are affected by CVE-2025-58920?

CVE-2025-58920 is a reflected cross-site scripting vulnerability affecting the Zootemplate Cerato WordPress theme through version 2.2.18 that allows unauthenticated attackers to execute malicious…

How to fix or mitigate CVE-2025-58920?

Within 24 hours: Inventory all WordPress installations using Zootemplate Cerato theme and document current versions. Within 7 days: Contact the theme vendor to confirm patch availability timeline; if unavailable, disable the theme or migrate to an alternative WordPress theme and alert users of the vulnerability. Within 30 days: Update to a patched version of Zootemplate Cerato once released by the vendor, or complete migration to a secure alternative theme.

Cerato CVE-2025-58920

EUVD-2025-209404 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-10 Patchstack

GHSA-whm2-488f-jvqp

XSS Cerato

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

EUVD ID Assigned

Apr 10, 2026 - 13:45 euvd

EUVD-2025-209404

Analysis Generated

Apr 10, 2026 - 13:45 vuln.today

CVE Published

Apr 10, 2026 - 13:25 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zootemplate Cerato allows Reflected XSS.This issue affects Cerato: from n/a through 2.2.18.

AnalysisAI

Reflected cross-site scripting in Zootemplate Cerato WordPress theme versions through 2.2.18 allows unauthenticated attackers to execute arbitrary JavaScript in victim browsers through crafted malicious links. Successful exploitation requires user interaction (victim must click attacker-controlled URL). Attack enables session hijacking, credential theft, and defacement within changed security context. No public exploit identified at time of analysis.

Technical ContextAI

Reflected XSS (CWE-79) stems from improper neutralization of user-supplied input before rendering in web pages. Attacker-controlled parameters are reflected in HTTP responses without sanitization or encoding. CVSS vector PR:N confirms unauthenticated attack surface; S:C indicates scope change enabling context escalation beyond vulnerable component.

RemediationAI

No vendor-released patch identified at time of analysis. Immediately deactivate Cerato theme and migrate to actively maintained alternative with vendor security support. If business continuity requires temporary continued use, implement web application firewall rules to sanitize all user-controllable parameters in HTTP requests, enforce Content Security Policy headers restricting inline script execution, and educate users against clicking untrusted links. Monitor Patchstack advisory for vendor patch announcements: https://patchstack.com/database/wordpress/theme/cerato/vulnerability/wordpress-cerato-theme-2-2-18-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve. Verify theme developer security contact channels for direct patch notification.