What is the CVSS score of CVE-2025-63032?

CVE-2025-63032 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Wordpress Theme CVE-2025-63032

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-31 audit@patchstack.com

WordPress XSS Wordpress Theme

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

6.5 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 12:16 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thinkupthemes Consulting consulting allows Stored XSS.This issue affects Consulting: from n/a through <= 1.5.0.

AnalysisAI

Stored cross-site scripting in thinkupthemes Consulting WordPress theme versions through 1.5.0 enables authenticated users or malicious admins to inject persistent JavaScript payloads that execute in the browsers of other site visitors or administrators. The vulnerability allows arbitrary script execution within the context of the affected WordPress installation, potentially leading to account compromise, malware distribution, or session hijacking. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

This vulnerability stems from improper input sanitization during web page generation, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The affected product is the Consulting WordPress theme by thinkupthemes, which renders user-supplied or admin-controlled input into HTML output without adequate escaping or validation. WordPress themes are PHP-based presentation layers that directly interact with the WordPress REST API and database to display dynamic content; when theme developers fail to use WordPress sanitization and escaping functions (such as wp_kses_post(), esc_html(), or wp_safe_remote_get()), stored XSS vulnerabilities can arise. This particular instance affects the theme through version 1.5.0, suggesting the vulnerability persists across multiple releases due to unchecked input handling in theme template files or plugin integrations.

Affected ProductsAI

The thinkupthemes Consulting WordPress theme is affected in all versions from initial release through version 1.5.0. The product is distributed via the WordPress theme repository and third-party marketplaces. WordPress theme CPE data is typically structured as cpe:2.3:a:thinkupthemes:consulting:*:*:*:*:*:wordpress:*:* (with version wildcards representing 1.5.0 and earlier). Affected installations include any WordPress site running the Consulting theme with version number less than or equal to 1.5.0. The vulnerability advisory is documented in the Patchstack database at https://patchstack.com/database/Wordpress/Theme/consulting/vulnerability/wordpress-consulting-theme-1-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve.

RemediationAI

Update the Consulting theme to a patched version greater than 1.5.0 by navigating to WordPress Dashboard → Appearance → Themes, locating the Consulting theme, and clicking 'Update' if available. If no update is available in the WordPress.org repository, contact thinkupthemes directly via the advisory link (https://patchstack.com/database/Wordpress/Theme/consulting/vulnerability/wordpress-consulting-theme-1-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve) for patched version details or temporary workarounds. As an interim mitigation, restrict editor and administrator roles to trusted users only, enforce strong passwords on all WordPress accounts, and consider using WordPress security plugins that filter malicious input in theme fields or scan for stored XSS patterns. Review site content and posts created by lower-privileged accounts for suspicious JavaScript code if the theme has been active on a public site.