Fitness Zone CVE-2025-69155

Exploitation requires victim user interaction (CVSS UI:R): a target must open an attacker-crafted request/link to a site running the Fitness Zone theme version 5.7 or earlier. No authentication is required of the attacker (PR:N), and the vector is network-based with low complexity, so no special server configuration beyond having the vulnerable theme active is needed. The key limiting factor is the reliance on tricking a user into loading the malicious input - ideally a high-privilege user for meaningful impact - meaning it cannot be exploited fully autonomously against the server; impact scales with the privilege of the victim whose browser executes the payload.

The CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L: network-reachable, low complexity, no privileges required, but user interaction is required - the victim must click a crafted link or load attacker-influenced content, which meaningfully limits mass automated exploitation. Impact is Low across confidentiality, integrity, and availability individually, but the scope change raises overall severity because script runs in the site origin. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. It is NOT in CISA KEV (no confirmed active exploitation) and no POC was referenced, so this is a credible but not urgent priority - typical of the large volume of Patchstack-reported WordPress theme/plugin XSS issues that are real but exploited opportunistically rather than at scale. The 'unauthenticated' label is consistent with PR:N in the provided vector.

An attacker crafts a URL to the WordPress site containing a malicious script payload in a parameter reflected by the Fitness Zone theme, then delivers it to a logged-in administrator via email, comment, or social engineering. When the admin opens the link (satisfying the UI:R requirement), the script executes in their authenticated session and can steal cookies, perform admin actions, or plant a backdoor. No public POC was referenced in the input.