CVE-2025-22687

The WordPress Tuaug4 theme, versions up to and including 1.4, contains a reflected Cross-Site Scripting (XSS) vulnerability. The issue stems from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary scripts into web pages [1].

Exploitation requires user interaction, such as clicking a crafted link or visiting a specially prepared page, and can be performed by any authenticated user with the required privilege level [1]. The attack does not require elevated privileges beyond what is normally available to such users.

Successful exploitation could allow an attacker to inject malicious scripts, including redirects, advertisements, or other HTML payloads. These scripts would execute when other users or guests visit the affected site, potentially leading to data theft, session hijacking, or defacement [1].

The vendor has not released an official patch; however, Patchstack provides a mitigation rule that can block attacks until an update is available. Immediate action is advised as the vulnerability is considered moderately dangerous and expected to become exploited in mass campaigns [1].