{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-0845", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-01-29T16:53:09.944Z", "datePublished": "2025-03-25T05:22:47.625Z", "dateUpdated": "2026-04-08T16:46:51.877Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:46:51.877Z"}, "affected": [{"vendor": "designthemes", "product": "DesignThemes Core Features", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The DesignThemes Core Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "DesignThemes Core Features <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/39ea4627-66b2-42a6-913e-04c708491b8d?source=cve"}, {"url": "https://themeforest.net/item/lms-learning-management-system-education-lms-wordpress-theme/7867581"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "timeline": [{"time": "2025-01-29T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-01-29T00:00:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-03-24T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-31T18:18:52.559629Z", "id": "CVE-2025-0845", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-31T18:19:02.098Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0845", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-31T18:18:52.559629Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-31T18:18:58.563Z"}}], "cna": {"title": "DesignThemes Core Features <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "designthemes", "product": "DesignThemes Core Features", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "4.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-01-29T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-01-29T00:00:00.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-03-24T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/39ea4627-66b2-42a6-913e-04c708491b8d?source=cve"}, {"url": "https://themeforest.net/item/lms-learning-management-system-education-lms-wordpress-theme/7867581"}], "descriptions": [{"lang": "en", "value": "The DesignThemes Core Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-03-25T05:22:47.625Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0845", "state": "PUBLISHED", "dateUpdated": "2025-03-31T18:19:02.098Z", "dateReserved": "2025-01-29T16:53:09.944Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-25T05:22:47.625Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The DesignThemes Core Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento DesignThemes Core Features para WordPress es vulnerable a cross site scripting almacenado mediante shortcodes en versiones hasta la 4.8, incluida, debido a una depuraci\u00f3n de entrada y al escape de salida insuficiente en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados con permisos de colaborador o superiores inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-0845", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-03-25T06:15:40.213", "references": [{"source": "security@wordfence.com", "url": "https://themeforest.net/item/lms-learning-management-system-education-lms-wordpress-theme/7867581"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/39ea4627-66b2-42a6-913e-04c708491b8d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T14:57:23.447624+00:00", "value": {"mitigation_remediation": ["Update DesignThemes Core Features plugin to a version newer than 4.8", "If immediate update is not possible, revoke Contributor or higher role permissions for users who should not create content with shortcodes", "Apply a WordPress security plugin or custom code to sanitize shortcode attributes or disable shortcode execution on public pages"], "summary": {"action": "Patch Update", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the DesignThemes Core Features plugin for WordPress, specifically all released versions up to and including 4.8. Users who run these versions without applying a newer update are at risk.", "description_and_impact": "The DesignThemes Core Features WordPress plugin up to version 4.8 contains a stored client\u2011side code\u2011injection flaw. Authenticated users with Contributor or higher roles can embed specially crafted shortcodes that include malicious attributes. When a user visits the affected page, the browser executes the injected script, potentially compromising user sessions or defacing content. The vulnerability stems from insufficient input sanitization and output escaping on user\u2011supplied attributes.", "risk_and_exploitability": "The CVSS score is 6.4, indicating a moderate severity. The EPSS score is less than 1%, suggesting a very low probability of exploitation at present, and the issue is not listed in the CISA KEV catalog. Attackers must first obtain Contributor or higher access to the WordPress site and then supply a malicious shortcode; no unauthenticated or remote exploitation path is described."}}}}, "created": "2025-07-13T11:07:26.579064+00:00", "updated": "2026-04-22T15:00:05.629907+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}