What is the CVSS score of CVE-2025-59560?

CVE-2025-59560 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Sonaar WordPress Theme are affected by CVE-2025-59560?

Sonaar WordPress theme (v4.27.4 and earlier) contains an unauthenticated cross-site scripting vulnerability allowing attackers to inject malicious scripts into pages visited by users.

How to fix or mitigate CVE-2025-59560?

24 hours: Audit all WordPress installations to identify Sonaar theme usage and enumerate affected versions (4.27.4 and earlier); document inventory of deployed instances. 7 days: Deploy Web Application Firewall rules blocking common XSS payloads; enforce Content Security Policy headers to restrict script execution (script-src 'self'); consider temporary theme deactivation if not business-critical. 30 days: Monitor Sonaar vendor advisories for patch availability; apply patched version immediately upon release; if no patch timeline emerges, execute migration plan to alternative WordPress themes.

Sonaar WordPress Theme CVE-2025-59560

EUVD-2025-210221 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-17 Patchstack

XSS Sonaar

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable WordPress theme, unauthenticated attacker, but requires victim click (UI:R); XSS escapes component scope (S:C) with partial C/I/A impact on victim session.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:46 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Sonaar <= 4.27.4 versions.

AnalysisAI

Reflected or stored cross-site scripting in the Sonaar WordPress theme versions 4.27.4 and earlier allows remote unauthenticated attackers to inject malicious script into pages rendered to victims who follow a crafted link or interact with attacker-controlled content. The CVSS scope-change vector (S:C) indicates the injected script can impact resources beyond the vulnerable component, such as the WordPress admin session of a logged-in user. No public exploit identified at time of analysis, and the issue is not on CISA's KEV list.

Technical ContextAI

Sonaar is a commercial WordPress theme marketed to musicians, bands, and audio producers (CPE cpe:2.3:a:sonaar_music:sonaar). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controlled input is reflected or stored into HTML output without proper output encoding or input sanitization. In a WordPress theme context this typically manifests in shortcodes, template parameters, search forms, comment fields, or AJAX endpoints exposed by the theme to unauthenticated visitors. Exploitation runs in the browser of the victim within the origin of the WordPress site, enabling theft of cookies, session tokens, or actions performed on behalf of an authenticated administrator if one is lured to the malicious payload.

RemediationAI

Upgrade the Sonaar theme to a version newer than 4.27.4 as published by the vendor; the exact fixed version is not stated in the provided intelligence, so consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/sonaar/vulnerability/wordpress-sonaar-theme-4-27-4-cross-site-scripting-xss-vulnerability and the Sonaar Music vendor changelog for the patched release identifier. As compensating controls while patching, deploy a web application firewall such as the Patchstack mTLS/vPatch service or Wordfence with rules that block reflected XSS payloads against theme endpoints, set a strict Content-Security-Policy header that disallows inline scripts (note this can break other themes/plugins that rely on inline JS), require administrators to use separate browser profiles to avoid session reuse, and audit any pages exposing Sonaar-rendered user input. Avoid temporarily switching themes only as a workaround unless a staging validation is performed, since theme changes can break widgets and customizations.