What is the CVSS score of CVE-2025-62936?

CVE-2025-62936 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

xSmart WordPress Theme CVE-2025-62936

MEDIUM

Basic XSS (CWE-80)

2025-10-27 audit@patchstack.com

WordPress XSS Wordpress Theme

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.4 MEDIUM

Victim must view injected page (UI:R); scope changes to victim browser (S:C); content injection enables page integrity modification (I:L).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 18:22 vuln.today

CVE Published

Oct 27, 2025 - 02:15 cve.org

MEDIUM 4.3

DescriptionCVE.org

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Jthemes xSmart xsmart allows Code Injection.This issue affects xSmart: from n/a through <= 1.2.9.4.

AnalysisAI

Content injection via stored script-tag HTML in the xSmart WordPress theme through version 1.2.9.4 allows low-privileged authenticated users to embed unsanitized HTML - including script-bearing tags - into pages served to other site visitors. The flaw originates from inadequate output escaping in the Jthemes-developed theme and is classified as CWE-80 (Basic XSS / HTML tag injection). No public exploit code or active exploitation has been identified; EPSS sits at 0.02% (6th percentile), consistent with low threat-actor interest at time of analysis.

Technical ContextAI

xSmart is a commercial WordPress theme developed by Jthemes, affecting all releases through version 1.2.9.4. CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page) denotes a failure to escape or sanitize HTML metacharacters - specifically script-related tags such as <script> or inline event handlers - before rendering user-supplied input in the browser. WordPress provides dedicated escaping functions (esc_html(), esc_attr(), wp_kses()) for this purpose; their absence or incorrect application in theme template code is the likely root cause. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms network reachability, low access complexity, and a requirement for low-privilege WordPress authentication to inject the payload. The advisory was sourced from Patchstack (audit@patchstack.com) and catalogued under the WordPress theme vulnerability class.

Affected ProductsAI

The xSmart WordPress theme by Jthemes is affected from an unspecified baseline through and including version 1.2.9.4. No CPE string was provided in the NVD data. Full vulnerability details are available via the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/xsmart/vulnerability/wordpress-xsmart-theme-1-2-9-4-content-injection-vulnerability?_s_id=cve.

RemediationAI

The primary fix is to update the xSmart WordPress theme to a version beyond 1.2.9.4 that resolves the content injection vulnerability; consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/xsmart/vulnerability/wordpress-xsmart-theme-1-2-9-4-content-injection-vulnerability?_s_id=cve for the exact patched release, as no patched version number was independently confirmed in the available data. If an updated theme version is not yet available from Jthemes, compensating controls include restricting WordPress user registration and limiting contributor or subscriber roles exclusively to trusted accounts (directly reducing the attacker pool), auditing existing posts and theme-generated pages for injected HTML artifacts, and deploying a WAF rule to strip or block script-bearing HTML tags in form submissions - noting that WAF filtering may inadvertently block legitimate rich-text content if the theme permits HTML input. No vendor advisory from Jthemes was identified in the reference data.