What is the CVSS score of CVE-2025-63075?

CVE-2025-63075 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

PHP CVE-2025-63075

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-09 audit@patchstack.com

WordPress PHP XSS

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 09, 2025 - 16:18 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in muffingroup Betheme betheme allows DOM-Based XSS.This issue affects Betheme: from n/a through <= 28.2.

AnalysisAI

DOM-based cross-site scripting (XSS) in muffingroup Betheme WordPress theme versions up to 28.2 allows authenticated attackers with low privileges to inject malicious scripts that execute in the context of other users' browsers. The vulnerability requires user interaction (UI:R) and affects the confidentiality, integrity, and availability of affected installations; EPSS exploitation probability is low at 0.04%, and no public exploit code or active exploitation has been confirmed.

Technical ContextAI

This is a CWE-79 DOM-based XSS vulnerability in a WordPress theme that fails to properly neutralize user-controlled input during web page generation. The attack vector is network-based with low complexity, meaning an attacker can craft a malicious link or embed a payload in a web request without advanced techniques. The vulnerability requires prior authentication (PR:L) and user interaction (UI:R), indicating the attacker must trick an authenticated user into clicking a link or performing an action that triggers the XSS payload. The Betheme theme, distributed via WordPress.org, processes user input in the DOM without adequate sanitization or output encoding, allowing script injection. The scope change (S:C) indicates the impact extends beyond the vulnerable component to affect other security domains.

Affected ProductsAI

muffingroup Betheme WordPress theme versions from an unspecified baseline through and including version 28.2. The theme is distributed via WordPress.org and is identified by CPE muffingroup Betheme. Detailed version-by-version impact scope is not provided in available data, though the advisory indicates all versions up to 28.2 are affected. Users should verify their current Betheme version in the WordPress admin dashboard to determine if they are within the vulnerable range.

RemediationAI

Update Betheme to a patched version released after 28.2. WordPress administrators should navigate to Appearance > Themes, locate Betheme, and apply any available updates; most patched versions should appear automatically in the WordPress update notification system. If automatic updates are disabled, manually download the latest Betheme release from the official WordPress.org theme repository. For additional guidance and confirmation of the patched version number, consult the advisory published at https://patchstack.com/database/Wordpress/Theme/betheme/vulnerability/wordpress-betheme-theme-28-1-7-cross-site-scripting-xss-vulnerability. No active workarounds are available; patching is the primary remediation path.