What is the CVSS score of EUVD-2025-28358?

EUVD-2025-28358 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Fitness Park are affected by EUVD-2025-28358?

CVE-2025-50033 presents notable security risk, a cross-site scripting vulnerability rated CVSS 6.5. Attackers could inject scripts to steal sessions or perform actions as authenticated users.

How to fix or mitigate EUVD-2025-28358?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Fitness Park EUVD-2025-28358

| CVE-2025-50033 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-06-20 audit@patchstack.com

WordPress XSS Wordpress Theme

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

AV:N, AC:L, PR:L, UI:R, S:C, C:L/I:L/A:L

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:R/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-28358

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

CVE Published

Jun 20, 2025 - 15:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sparkle Themes Fitness Park allows DOM-Based XSS. This issue affects Fitness Park: from n/a through 1.1.1.

AnalysisAI

DOM-Based Cross-Site Scripting (XSS) in the Fitness Park WordPress theme through version 1.1.1 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. The vulnerability is triggered when a user interacts with a crafted link, leading to script execution in the victim's browser. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).

Technical ContextAI

The vulnerability is a DOM-Based XSS (CWE-79) in the Fitness Park WordPress theme. DOM-Based XSS occurs when client-side JavaScript processes user input unsafely, modifying the DOM environment. The affected product is a WordPress theme, identified via CPE strings (if available) as 'fitness-park' by Sparkle Themes. The root cause is improper neutralization of input during web page generation, allowing script injection via the DOM.

RemediationAI

Update the Fitness Park theme to version 1.2.0 or later, as per the vendor advisory at Patchstack. No workaround is available; upgrading is the only fix. Ensure all WordPress themes and plugins are kept up to date.