{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9861", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-02T15:54:28.647Z", "datePublished": "2025-09-11T07:24:51.088Z", "dateUpdated": "2026-04-08T16:45:18.977Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:45:18.977Z"}, "affected": [{"vendor": "livingos", "product": "ThemeLoom Widgets", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.8.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The ThemeLoom Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'los_showposts' shortcode in all versions up to, and including, 1.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "ThemeLoom Widgets <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/327b7a35-59fc-4971-9d3f-10665e1725f7?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/themeloom-widgets/trunk/show-widgets.php#L402"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Gilang Asra Bilhadi"}], "timeline": [{"time": "2025-09-10T18:53:50.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-11T14:10:16.398532Z", "id": "CVE-2025-9861", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:41:07.861Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9861", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-11T14:10:16.398532Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:10:18.649Z"}}], "cna": {"title": "ThemeLoom Widgets <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Gilang Asra Bilhadi"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "livingos", "product": "ThemeLoom Widgets", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.8.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-10T18:53:50.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/327b7a35-59fc-4971-9d3f-10665e1725f7?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/themeloom-widgets/trunk/show-widgets.php#L402"}], "descriptions": [{"lang": "en", "value": "The ThemeLoom Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'los_showposts' shortcode in all versions up to, and including, 1.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:45:18.977Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9861", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:45:18.977Z", "dateReserved": "2025-09-02T15:54:28.647Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-11T07:24:51.088Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The ThemeLoom Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'los_showposts' shortcode in all versions up to, and including, 1.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-9861", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-09-11T08:15:39.677", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/themeloom-widgets/trunk/show-widgets.php#L402"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/327b7a35-59fc-4971-9d3f-10665e1725f7?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T03:06:20.085514+00:00", "value": {"mitigation_remediation": ["Upgrade ThemeLoom Widgets to the latest available version (1.8.6 or later) to receive the input sanitization fix.", "If upgrading is not feasible, revoke contributor-level access or downgrade contributors to a non\u2011privileged role so that malicious configuration cannot be injected.", "Deploy a Content Security Policy or use a security plugin that blocks inline script execution to mitigate the impact of stored XSS on end\u2011user browsers."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting leading to execution of arbitrary scripts in users' browsers"}, "threat_synthesis": {"affected_systems": "The affected product is the ThemeLoom Widgets plugin from livingOS, a WordPress plugin available in versions 1.8.5 and earlier. It runs on WordPress sites that have installed the plugin. Sites that rely on the los_showposts shortcode for displaying posts or content are vulnerable.", "description_and_impact": "The ThemeLoom Widgets plugin for WordPress stores configuration information for widgets in the database, and its los_showposts shortcode processes attributes without adequate sanitization or escaping. Because of this, an authenticated contributor or higher can inject arbitrary JavaScript into widget attributes. When a page containing that widget is rendered, the malicious code runs in every visitor\u2019s browser, enabling client\u2011side attacks such as cookie theft or session hijacking. The flaw is a classic stored cross\u2011site scripting vulnerability (CWE\u201179).", "risk_and_exploitability": "The CVSS 3.1 base score is 6.4, indicating a moderate severity. The EPSS score is reported as less than 1%, suggesting a low probability of exploitation at the time of assessment. The vulnerability is not listed in the CISA KEV catalog. Attackers need only contributor-level access or higher within the WordPress site to exploit the flaw, making authenticated users the likely vector. The stored nature of the payload means that once injected, the malicious script persists until the widget configuration is removed or the site is patched."}}}}, "created": "2025-09-12T08:03:07.625933+00:00", "updated": "2026-04-21T03:15:16.329435+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}