SpaLab Beauty Salon Theme CVE-2025-69154

Exploitation requires no authentication (PR:N) and is network-reachable (AV:N), but is limited by mandatory victim interaction (UI:R) - the target user must click or load an attacker-crafted link/page that reaches a vulnerable input handler in the SpaLab | Beauty Salon theme. The site must have this specific designthemes theme (version 6.7 or earlier) installed and active; sites not running SpaLab are unaffected. The precise vulnerable parameter or feature is not disclosed in the provided description, so defenders should treat any theme-processed request input as potentially affected; the highest-value outcome depends on the victim being an authenticated administrator whose session the injected script can abuse.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L = 7.1, High) indicates network-reachable, low-complexity exploitation with no privileges required, but it is gated by required user interaction (UI:R) - a victim must click a crafted link or load an attacker-influenced page. This UI:R requirement materially lowers real-world urgency relative to a no-interaction flaw. The impact metrics are all Low (C:L/I:L/A:L), typical for XSS: session/token theft, limited content manipulation, and possible client-side disruption rather than full server compromise. No EPSS score, no CISA KEV listing, and no POC were provided, so there is no evidence of active or automated exploitation - this reads as a moderate-priority issue whose severity is driven mainly by the scope change and unauthenticated nature rather than by demonstrated real-world attack activity. Note the input provides no EPSS value, so exploitation-probability signal is missing and cannot be weighed.

An attacker crafts a URL containing a malicious script payload in a parameter processed by the SpaLab theme and delivers it to a site visitor or logged-in administrator via email, social media, or a malicious page. When the victim clicks the link, the unsanitized input is reflected into the page and the injected JavaScript runs in their browser session, enabling cookie/session theft, unauthorized actions, or content defacement. No public proof-of-concept was provided in the input, and successful exploitation depends on the victim interacting with the attacker-supplied link (UI:R).