Sahifa Theme CVE-2025-64202

Exploitation requires the TieLabs Sahifa WordPress theme at a version at or below 5.8.6, an authenticated session (PR:L per the CVSS vector), and victim user interaction (UI:R) such as loading a crafted page or clicking an attacker-supplied link that reaches the vulnerable client-side DOM sink. These factors - needing valid authentication plus a human victim action rather than fully autonomous remote exploitation - substantially limit realistic exploitation and keep the practical risk below the raw network-vector score. No specific non-default configuration is named in the description, so exploitation applies to the affected Sahifa versions generally.

This is a moderate-severity, low-priority issue in practice. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5) describes a network-reachable but constrained flaw: it requires an authenticated user (PR:L) AND victim interaction (UI:R), with only Low impact to confidentiality, integrity, and availability. The scope change (S:C) reflects the typical DOM-based XSS pattern where injected script executes in the victim's browser context beyond the vulnerable component. Exploitation signals are weak and mutually consistent: EPSS is only 0.17% (5th percentile), there is no CISA KEV listing, and no public exploit was identified in the provided data. In short, no signals conflict - all point to low real-world exploitation likelihood. This is a legitimate bug to patch but not an emergency; it is a typical Patchstack-catalogued WordPress theme XSS rather than a high-urgency threat. One caveat: the A:L (availability) impact is unusual for a classic XSS and the PR:L (authenticated) requirement is Patchstack's assessment - both are worth verifying against the vendor advisory, as DOM-based XSS impact scoring varies between sources.

An authenticated low-privilege user (or an attacker who lures an authenticated victim) causes attacker-controlled input to be reflected into the DOM without proper neutralization, and when a victim loads the crafted page or clicks a crafted link, the script executes in their browser session. Because user interaction is required (UI:R) and no public exploit is identified, real-world abuse would be opportunistic rather than automated, typically aimed at hijacking a logged-in admin's session or performing actions in the WordPress admin context.