EUVD-2025-210405
GHSA-6cxj-rvj8-j8p8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious URL with XSS payload
-
DeliveryDeliver link to victim via phishing
-
ExploitVictim loads reflected page in browser
-
ExecutionInjected JavaScript executes in site origin
-
ImpactSteal session or perform actions as user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker to deliver a crafted link containing the XSS payload and to have a victim load it in a browser - the CVSS UI:R metric confirms user interaction is mandatory, which is the key limiting factor. No authentication is needed (PR:N), so any anonymous attacker can generate the malicious link against a site running Trendy Travel theme version 6.7 or earlier. The reflected (non-persistent) nature means the payload is not stored server-side, so each victim must be individually lured; impact is greatest when the victim is an authenticated WordPress user (e.g. an administrator) whose session context the injected script can abuse. Exploitation is limited to sites actually running the affected theme. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1 High) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (UI:R) - the victim must click or load a crafted link, which is the primary limiting factor typical of reflected XSS. Impact is rated Low across confidentiality, integrity, and availability, consistent with script-in-browser rather than direct server compromise. There is no CISA KEV listing and no POC referenced, so this is not confirmed actively exploited; no EPSS probability was provided, leaving statistical likelihood unquantified from the input. Overall this is a legitimate but moderate-priority issue: real because the attack vector is remote and unauthenticated, but gated by user interaction and limited to low technical impact, so it ranks below unauthenticated RCE or stored/persistent XSS. No SSVC decision data was supplied. |
| Exploit ScenarioDerived | An attacker crafts a URL to the target WordPress site containing a malicious script payload in a reflected parameter and delivers it via phishing email, social media, or a malicious ad. When a logged-in administrator or ordinary visitor clicks the link, the theme reflects the payload into the page and the browser executes it in the site's origin, enabling session/cookie theft, forced admin actions, or redirection. No public POC is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 02, 2026
Reflected cross-site scripting in the Trendy Travel WordPress theme (versions 6.7 and earlier) by designthemes lets remote unauthenticated attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Rated CVSS 7.1 with a scope change (S:C), reflecting that injected script can act across the WordPress security boundary. No public exploit identified at time of analysis, and no EPSS score was supplied.
RemediationAI
No vendor-released patch version is identified in the provided data, so upgrade to a fixed release cannot be cited with an exact number - monitor the designthemes/Trendy Travel changelog and the Patchstack advisory (https://patchstack.com/database/wordpress/theme/trendytravel/vulnerability/wordpress-trendy-travel-theme-6-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) for a version above 6.7 and update as soon as one is released. As compensating controls until a patch is applied, place a Web Application Firewall (such as Patchstack's or a comparable WordPress WAF) in front of the site to filter reflected-XSS payloads in request parameters, which is low-impact but may miss novel encodings; add a restrictive Content-Security-Policy that disallows inline script execution to blunt injected JavaScript, accepting that it can break legitimate inline scripts and require tuning; and if the vulnerable theme endpoint or parameter is non-essential, restrict or block access to it at the reverse proxy, at the cost of any functionality that relies on it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Trendy Travel, a commercial travel-oriented WordPress theme published under the designthemes vendor (CPE cpe:2.3:a:designthemes:trendy_travel). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): a request-derived parameter is reflected back into an HTML response without adequate output encoding or input sanitization, so attacker-controlled markup is parsed as active content by the browser. Because this is a theme (front-end presentation layer), the vulnerable code path is reachable on public-facing pages rendered to any visitor, and the CVSS scope change (S:C) indicates the executed script can affect resources beyond the vulnerable component, e.g. the authenticated WordPress session or admin context.
Know when Trendy Travel gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Remote unauthenticated reflected XSS needing victim click (UI:R); executed script crosses into the WordPress session context (S:C) with limited low C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Trendy Travel <= 6.7 versions.
Executive ViewAI
Trendy Travel WordPress theme (versions 6.7 and earlier) contains a reflected XSS vulnerability allowing unauthenticated attackers to inject malicious scripts executed in any website visitor's browser; no public exploit has been identified at time of analysis. Organizations deploying this theme face direct risk of user credential theft and device compromise if visitors are directed to crafted malicious links.
No vendor-released patch identified at time of analysis. Interim mitigations: Deploy Web Application Firewall rules to block reflected XSS patterns; implement Content Security Policy headers; disable theme on non-critical sites; disable user plugin uploads if enabled; conduct security awareness training on risks of following untrusted links to your domain.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB