Rehub Theme CVE-2025-64197

Exploitation requires an authenticated account with at least low-privilege content-submission rights on the Rehub theme site (PR:L) - not anonymous/default access - plus victim interaction, since the stored payload only executes when another user or administrator later views the affected page (UI:R). This limits realistic exploitation to sites that provision multiple or lower-trust user roles (multi-author blogs, membership/marketplace sites); single-admin installations have a substantially reduced attack surface. The specific vulnerable input field is not named in the available description. Upgrading to Rehub 19.9.9.1 or later is the stated fix boundary.

This is a stored XSS flaw (CWE-79) in the commercial Rehub WordPress theme by sizam, carrying a moderate CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The vector indicates a network-reachable, low-complexity attack but requires an authenticated low-privilege account (PR:L) and victim interaction (UI:R), with a scope change (S:C) reflecting script execution in another user's browser context and only Low impact across confidentiality, integrity, and availability. The real-world exploitation signals are weak: EPSS is just 0.20% (9th percentile), the vulnerability is NOT in CISA KEV, and no public exploit code was identified in the provided sources - so exploitation status is 'no public exploit identified at time of analysis.' These signals are consistent rather than conflicting: a moderate-severity, authentication-gated stored XSS with low EPSS is a routine patch-management item, not an emergency. It is a genuine but lower-priority issue - meaningful in multi-author or membership WordPress sites where lower-privileged accounts exist, but not a high-urgency, widely-weaponized threat. The data is sourced solely from Patchstack via NVD; no independent vendor advisory text was provided, so affected-version precision ('n/a through < 19.9.9.1') should be verified against the sizam changelog.

An authenticated low-privilege user (e.g. a contributor or author on a multi-author Rehub site) submits content containing a malicious script payload into a theme input field that is not properly neutralized. The payload is stored and later rendered when an administrator or other user views the affected page, executing attacker-controlled JavaScript in the victim's browser session. No public proof-of-concept was identified at the time of analysis.