{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5587", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-03T22:19:04.229Z", "datePublished": "2025-07-29T11:19:02.293Z", "dateUpdated": "2026-04-08T16:52:27.730Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:52:27.730Z"}, "affected": [{"vendor": "sparklewpthemes", "product": "Appzend", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Appzend theme for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018progressbarLayout\u2019 parameter in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Appzend <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via progressbarLayout Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/51214cd0-23a6-48ba-a3d8-4d9a0a9e52df?source=cve"}, {"url": "https://themes.trac.wordpress.org/browser/appzend/1.2.6/blocks-extends/blocks/progressbar.php#L44"}, {"url": "https://wordpress.org/themes/appzend/"}, {"url": "https://themes.trac.wordpress.org/changeset/281244/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "timeline": [{"time": "2025-07-28T22:43:42.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-29T13:56:10.000718Z", "id": "CVE-2025-5587", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-29T13:56:42.663Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5587", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-29T13:56:10.000718Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-29T13:56:17.889Z"}}], "cna": {"title": "Appzend <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via progressbarLayout Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "sparklewpthemes", "product": "Appzend", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.2.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-28T22:43:42.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/51214cd0-23a6-48ba-a3d8-4d9a0a9e52df?source=cve"}, {"url": "https://themes.trac.wordpress.org/browser/appzend/1.2.6/blocks-extends/blocks/progressbar.php#L44"}, {"url": "https://wordpress.org/themes/appzend/"}, {"url": "https://themes.trac.wordpress.org/changeset/281244/"}], "descriptions": [{"lang": "en", "value": "The Appzend theme for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018progressbarLayout\u2019 parameter in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-07-29T11:19:02.293Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5587", "state": "PUBLISHED", "dateUpdated": "2025-07-29T13:56:42.663Z", "dateReserved": "2025-06-03T22:19:04.229Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-29T11:19:02.293Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Appzend theme for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018progressbarLayout\u2019 parameter in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El tema Appzend para WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s del par\u00e1metro 'progressbarLayout' en todas las versiones hasta la 1.2.6 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficiente. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en las p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-5587", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-07-29T12:15:26.293", "references": [{"source": "security@wordfence.com", "url": "https://themes.trac.wordpress.org/browser/appzend/1.2.6/blocks-extends/blocks/progressbar.php#L44"}, {"source": "security@wordfence.com", "url": "https://themes.trac.wordpress.org/changeset/281244/"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/themes/appzend/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/51214cd0-23a6-48ba-a3d8-4d9a0a9e52df?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T04:01:52.193083+00:00", "value": {"mitigation_remediation": ["Upgrade the Appzend theme to the latest released version where the progressbarLayout parameter is properly validated and escaped.", "Restrict the Contributor\u2011level or higher roles from editing blocks that include the progressbar block, limiting the ability to modify that parameter to trusted administrators.", "Deploy a Content Security Policy that blocks inline scripts and limits script sources, thereby reducing the impact of any injected code."], "summary": {"action": "Patch Now", "impact": "Authenticated Stored XSS"}, "threat_synthesis": {"affected_systems": "All installations of the Appzend theme from sparklewpthemes up to and including version 1.2.6 are affected. Any WordPress site that deploys this theme and permits Contributors or higher to edit the progressbar block is vulnerable. The risk exists only on sites that have a user with sufficient role privileges and do not otherwise restrict that capability.", "description_and_impact": "The Appzend WordPress theme contains a stored cross\u2011site scripting flaw in the progressbarLayout parameter. Because the input is not sanitized and the output is not escaped, an attacker who has authenticated Contributor\u2011level or higher permissions can inject arbitrary JavaScript that will be saved and rendered whenever a page containing the affected block is viewed. This flaw allows the attacker to run malicious code in the browsers of anyone who visits the injected page.", "risk_and_exploitability": "The CVSS score of 6.4 indicates medium severity. The EPSS score of < 1% suggests a very low probability of exploitation at present, and the vulnerability is not listed in CISA's KEV catalog. However, because the flaw requires authenticated access, attackers need a valid Contributor or higher account, which may exist on many sites. If such a user could gain additional privileges or the site is exposed to social\u2011engineering attacks, the stored scripts could compromise confidentiality or integrity of the site or its visitors."}}}}, "created": "2025-07-30T06:15:19.859415+00:00", "updated": "2026-04-22T04:15:07.533440+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}