Sonaar WordPress Theme CVE-2025-59560

Exploitation requires that the target WordPress site has the Sonaar theme installed and active at version 4.27.4 or earlier, and that a victim user interacts with attacker-controlled content (UI:R in CVSS) - typically clicking a crafted link, viewing an injected page, or loading a comment/profile field that reaches the vulnerable Sonaar template. No authentication is required from the attacker (PR:N), but the specific Sonaar feature, shortcode, or parameter that reflects unsanitized input is not disclosed in the available advisory data, so the exact entry point cannot be confirmed without consulting the Patchstack writeup. Maximum impact (admin takeover) further requires that the victim user be a logged-in WordPress administrator at the time of payload execution.

The CVSS 3.1 base score of 7.1 reflects network attack vector, low complexity, no privileges required, but mandatory user interaction (UI:R) combined with a scope change (S:C) and low partial impact across confidentiality, integrity, and availability - characteristic of stored/reflected XSS against WordPress sites. EPSS data was not provided in the input, and the vulnerability is not on CISA KEV, so there is no signal of mass automated exploitation; however, XSS against WordPress themes is a well-trodden path for credential and session theft and is often weaponized opportunistically once details are public. The Patchstack advisory exists but the input does not specify whether a POC is publicly published, so exploit maturity is uncertain. Overall this is a meaningful but not emergency-priority issue for sites running Sonaar - patch promptly but it is not on the same tier as RCE.

An attacker crafts a malicious URL or comment containing a JavaScript payload targeting a vulnerable Sonaar-rendered parameter and lures a site administrator or visitor to click it (UI:R). When the page renders, the script executes in the victim's browser under the WordPress site's origin, allowing the attacker to steal session cookies, perform authenticated actions such as creating a new admin user, or pivot to backend WordPress compromise.