CVE-2025-63073
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dream-Theme The7 dt-the7 allows DOM-Based XSS.This issue affects The7: from n/a through < 12.9.0.
Analysis
DOM-based cross-site scripting in Dream-Theme The7 WordPress theme versions before 12.9.0 allows authenticated users to inject malicious scripts that execute in the context of other users' browsers via improperly sanitized input during web page generation. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting real-world exploitability despite a moderate CVSS score of 6.5. EPSS exploitation probability is low at 0.04th percentile, and no public exploit code or active exploitation has been reported.
Technical Context
This is a DOM-based cross-site scripting vulnerability (CWE-79) in the Dream-Theme The7 WordPress theme, a widely-used WordPress theme package distributed via WordPress.org. The vulnerability stems from improper neutralization of user-controlled input during dynamic HTML generation in the client-side DOM, allowing attackers to inject arbitrary JavaScript that executes in the victim's browser context. The attack vector is network-based, but exploitation requires an authenticated user account with at least limited privileges (PR:L per CVSS vector) and relies on social engineering or phishing to trick a victim into clicking a malicious link or interacting with a crafted payload (UI:R). The impact spans confidentiality, integrity, and availability (C:L/I:L/A:L), meaning the attacker could steal session tokens, modify page content, or disrupt service for individual users, with scope change (S:C) indicating the vulnerability can affect resources beyond the vulnerable component itself.
Affected Products
Dream-Theme The7 WordPress theme (CPE: wp:theme:the7 or similar Dream-Theme namespace) versions from an unspecified baseline through version 12.8.0 are affected. The vulnerability is fixed in The7 version 12.9.0 and later. The theme is distributed via the WordPress.org theme repository and commonly used on WordPress sites requiring a modern, feature-rich design framework.
Remediation
Immediately upgrade Dream-Theme The7 to version 12.9.0 or later, which contains the fix for this DOM-based XSS vulnerability. Website administrators should navigate to Appearance → Themes in their WordPress dashboard, locate The7, and click Update if available. For sites unable to upgrade immediately, restrict user account creation and audit existing user accounts to remove or downgrade any suspicious or unnecessary authenticated accounts, limiting the pool of potential attackers. Additional security measures include implementing a Web Application Firewall (WAF) rule to detect and block DOM-XSS payloads in URLs and implementing Content Security Policy (CSP) headers to mitigate the impact of any injected scripts. Refer to the Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Theme/dt-the7/vulnerability/wordpress-the7-theme-12-8-0-2-cross-site-scripting-xss-vulnerability for detailed advisory information.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today