What is the CVSS score of EUVD-2025-19977?

EUVD-2025-19977 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Pressroom WordPress Theme are affected by EUVD-2025-19977?

The Pressroom WordPress theme (QuanticaLabs, versions through 6.9) contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in…

How to fix or mitigate EUVD-2025-19977?

Within 24 hours, inventory all WordPress installations to identify deployments of Pressroom theme versions through 6.9 and determine which are customer-facing or contain sensitive content. Within 7 days, deploy Web Application Firewall rules to detect and block reflected XSS payloads, implement or tighten Content Security Policy headers with strict script-src directives, and establish monitoring for any phishing campaigns distributing malicious URLs targeting the theme. Within 30 days, evaluate theme replacement with a maintained alternative, implement custom input sanitization and output encoding controls if the theme is business-critical, or disable the theme entirely if its functions can be served by other components.

Pressroom WordPress Theme EUVD-2025-19977

| CVE-2025-32311 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-07-04 audit@patchstack.com

WordPress XSS Wordpress Theme

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Reflected XSS with no authentication needed and scope change into browser; A:N because XSS does not meaningfully impair availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 02:42 euvd

EUVD-2025-19977

Analysis Generated

Mar 16, 2026 - 02:42 vuln.today

CVE Published

Jul 04, 2025 - 12:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs Pressroom - News Magazine WordPress Theme allows Reflected XSS. This issue affects Pressroom - News Magazine WordPress Theme: from n/a through 6.9.

AnalysisAI

Reflected Cross-Site Scripting in the Pressroom - News Magazine WordPress Theme (QuanticaLabs) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL. All theme versions through 6.9 are affected. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS sits at 0.03% (9th percentile), consistent with a niche WordPress theme with limited real-world deployment.

Technical ContextAI

The flaw is a classic Reflected XSS (CWE-79): user-supplied input from a URL parameter is echoed back into the HTML response without adequate output encoding or sanitization. Because the WordPress theme controls its own template rendering, a vulnerable query parameter is reflected directly into the page markup. The CVSS scope change (S:C) models the fact that the injected script executes in the victim's browser - a different security boundary from the web server - allowing theft of session cookies, credential phishing overlays, or forced actions on the WordPress site on behalf of the victim. Affected product: Pressroom - News Magazine WordPress Theme by QuanticaLabs, versions from the initial release through 6.9 inclusive.

RemediationAI

The Patchstack advisory identifies version 6.9 as the last vulnerable release, implying a patched version beyond 6.9 may exist; however, no explicit fixed version number appears in the available input data - upgrade to the latest available release from the QuanticaLabs marketplace or the WordPress theme repository and verify it exceeds version 6.9. As a compensating control while awaiting an update, a WAF rule blocking reflected payloads on URL parameters specific to this theme's endpoints can reduce risk without disabling the theme. WordPress-level output escaping hardening (e.g., enforcing a Content Security Policy header that disallows inline scripts) limits exploitability but does not eliminate the underlying flaw. Restricting access to the WordPress admin area to known IPs reduces the impact of any successful XSS session-hijack attack.