What is the CVSS score of CVE-2025-63073?

CVE-2025-63073 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

PHP CVE-2025-63073

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-09 audit@patchstack.com

WordPress PHP XSS

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 09, 2025 - 16:18 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dream-Theme The7 dt-the7 allows DOM-Based XSS.This issue affects The7: from n/a through < 12.9.0.

AnalysisAI

DOM-based cross-site scripting in Dream-Theme The7 WordPress theme versions before 12.9.0 allows authenticated users to inject malicious scripts that execute in the context of other users' browsers via improperly sanitized input during web page generation. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting real-world exploitability despite a moderate CVSS score of 6.5. EPSS exploitation probability is low at 0.04th percentile, and no public exploit code or active exploitation has been reported.

Technical ContextAI

This is a DOM-based cross-site scripting vulnerability (CWE-79) in the Dream-Theme The7 WordPress theme, a widely-used WordPress theme package distributed via WordPress.org. The vulnerability stems from improper neutralization of user-controlled input during dynamic HTML generation in the client-side DOM, allowing attackers to inject arbitrary JavaScript that executes in the victim's browser context. The attack vector is network-based, but exploitation requires an authenticated user account with at least limited privileges (PR:L per CVSS vector) and relies on social engineering or phishing to trick a victim into clicking a malicious link or interacting with a crafted payload (UI:R). The impact spans confidentiality, integrity, and availability (C:L/I:L/A:L), meaning the attacker could steal session tokens, modify page content, or disrupt service for individual users, with scope change (S:C) indicating the vulnerability can affect resources beyond the vulnerable component itself.

Affected ProductsAI

Dream-Theme The7 WordPress theme (CPE: wp:theme:the7 or similar Dream-Theme namespace) versions from an unspecified baseline through version 12.8.0 are affected. The vulnerability is fixed in The7 version 12.9.0 and later. The theme is distributed via the WordPress.org theme repository and commonly used on WordPress sites requiring a modern, feature-rich design framework.

RemediationAI

Immediately upgrade Dream-Theme The7 to version 12.9.0 or later, which contains the fix for this DOM-based XSS vulnerability. Website administrators should navigate to Appearance → Themes in their WordPress dashboard, locate The7, and click Update if available. For sites unable to upgrade immediately, restrict user account creation and audit existing user accounts to remove or downgrade any suspicious or unnecessary authenticated accounts, limiting the pool of potential attackers. Additional security measures include implementing a Web Application Firewall (WAF) rule to detect and block DOM-XSS payloads in URLs and implementing Content Security Policy (CSP) headers to mitigate the impact of any injected scripts. Refer to the Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Theme/dt-the7/vulnerability/wordpress-the7-theme-12-8-0-2-cross-site-scripting-xss-vulnerability for detailed advisory information.