Sanzo CVE-2026-25355

This vulnerability presents a significant real-world risk despite missing CVSS and EPSS scores. The stored nature of the XSS significantly elevates severity compared to reflected variants—exploitation does not require social engineering or phishing victims to a malicious URL. The ENISA EUVD tracking (EUVD-2026-15673) indicates formal EU vulnerability database inclusion, suggesting coordinated disclosure and widespread awareness. Without explicit KEV status data provided, the absence of a CVSS vector prevents formal severity calculation, but CWE-79 stored XSS in widely-deployed WordPress themes typically warrants immediate patching due to high attack surface. The fact that a patch exists (version 2.4.3) and the vulnerability is documented by reputable sources like Patchstack suggests this is an actively managed vulnerability rather than a theoretical issue. Organizations running affected Sanzo versions should treat this as high-priority for remediation.

An attacker submits malicious JavaScript code through a vulnerable input field (such as a comment, custom field, or theme option) that lacks proper sanitization. The script is stored in the database without being escaped. When any user visits the affected page or dashboard, the stored XSS payload executes in their browser with their privileges, allowing the attacker to steal authentication cookies, create unauthorized admin accounts, or inject drive-by download exploits. Since this is stored XSS, the attack persists and affects all site visitors until the malicious content is removed or the theme is patched.