ThimPress Eduma CVE-2025-64194

Exploitation requires an authenticated account on the Eduma WordPress site (PR:L - a low-privileged but non-anonymous user, consistent with the theme's multi-role LMS model of instructors/students), the ability to submit input that Eduma stores and later renders without proper neutralization, and victim user interaction (UI:R) - a second user (such as an administrator) must view the page containing the stored payload for the script to fire. Limiting factors: no anonymous/unauthenticated path (an account is needed), exploitation is bounded to sites running vulnerable Eduma versions (through 5.7.6), and impact is scoped to actions executable in the victim's browser session rather than direct server compromise. The specific injectable field/feature is not named in the available data.

This is a moderate-severity stored XSS (CVSS 6.5) that signals do NOT elevate to urgent priority. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) describes a network-reachable but authenticated attack (PR:L) that also depends on victim interaction (UI:R); the scope change (S:C) reflects the classic stored-XSS trait of the injected payload executing in a different security context (another user's browser/session), which is what drives the three Low impacts across C/I/A. Exploitation-likelihood signals are all low-to-absent: EPSS is 0.20% (9th percentile), there is no CISA KEV listing, and no public exploit code is referenced. These signals are consistent and mutually reinforcing - a low-EPSS, non-KEV, no-POC authenticated XSS in a WordPress theme is a routine patch-management item, not an emergency. The main caveat is that the required privilege level is not specified in the description (PR:L in CVSS implies some authenticated role, but the exact role - contributor vs. admin - is not confirmed from the input); if the injectable field is reachable by low-trust roles like contributor/subscriber on multi-author sites, real-world risk is somewhat higher than the numbers suggest.

An attacker holding a low-privileged authenticated account on an Eduma-powered WordPress site (e.g., an instructor or contributor role) submits a malicious JavaScript payload into a vulnerable input field, where it is stored persistently. When a site administrator or another user later views the page rendering that stored data, the script executes in their browser context, enabling session/cookie theft or actions on their behalf. No public exploit code is identified at time of analysis, and successful attack requires both authenticated submission and a victim viewing the affected content.