What is the CVSS score of EUVD-2025-209960?

EUVD-2025-209960 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Themebox are affected by EUVD-2025-209960?

A reflected cross-site scripting vulnerability in the Themebox WordPress e-commerce theme (versions through 1.4.2) allows unauthenticated attackers to hijack store administrator and customer sessions…

How to fix or mitigate EUVD-2025-209960?

24 HOURS: Identify all WordPress instances running Themebox through version 1.4.2; implement Web Application Firewall rules to block reflected XSS patterns; restrict WordPress admin dashboard access to essential personnel only. 7 DAYS: Monitor Jthemes official advisory channels for patch release; if available, test thoroughly in staging environment before production deployment; if unavailable, deploy Content Security Policy headers with strict script-src restrictions and enable detailed request logging. 30 DAYS: Complete comprehensive inventory of all Themebox installations; enforce multi-factor authentication on all WordPress administrator accounts; establish continuous monitoring and alerting for XSS exploitation attempts.

Themebox EUVD-2025-209960

| CVE-2025-52747 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 audit@patchstack.com

GHSA-c7x5-qpfw-5h38

XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:31 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jthemes Themebox - Digital Products Ecommerce allows Reflected XSS.

This issue affects Themebox - Digital Products Ecommerce: from n/a through 1.4.2.

AnalysisAI

Reflected cross-site scripting in Jthemes' Themebox - Digital Products Ecommerce WordPress theme (versions through 1.4.2) lets an unauthenticated attacker inject script that executes in a victim's browser when they follow a crafted link. With CVSS 7.1 (scope-changed, low impact across confidentiality, integrity and availability), successful exploitation can hijack session context or perform actions in the WordPress admin/store context, though it requires the victim to click an attacker-supplied URL. No public exploit identified at time of analysis, and EPSS is very low at 0.03% (10th percentile), indicating minimal observed exploitation interest.

Technical ContextAI

Themebox - Digital Products Ecommerce is a commercial WordPress theme by Jthemes used to build digital-product storefronts. The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), the root cause class for cross-site scripting: attacker-controlled input is reflected back into an HTML response without proper output encoding or contextual sanitization. Because this is reflected XSS, the malicious payload is not stored server-side but is delivered through a request parameter that the theme echoes into a generated page. No CPE strings were supplied in the input; the affected component is identified through the Patchstack/EUVD advisory and version data rather than NVD CPE configurations.

RemediationAI

No vendor-released patch version is identified in the available data; the supplied references include only the Patchstack advisory and do not name a fixed release, so administrators should consult the Patchstack entry (https://patchstack.com/database/wordpress/theme/themebox/vulnerability/wordpress-themebox-digital-products-ecommerce-theme-1-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve) and the Jthemes vendor channel for any release newer than 1.4.2 and upgrade as soon as one is published. Until a fixed version is confirmed, compensating controls include deploying a WordPress-aware web application firewall or virtual patch (Patchstack offers one for this CVE) to filter reflected-XSS payloads in request parameters; adding a restrictive Content-Security-Policy header to constrain inline/external script execution (trade-off: may break legitimate theme scripts and require tuning); and setting HttpOnly on session cookies to blunt cookie theft (trade-off: does not stop DOM actions or non-cookie attacks). Avoid following untrusted links to the affected site and consider restricting or monitoring access to admin pages.