CVE-2025-31072

The Ofiz WordPress Business Consulting Theme versions up to 2.0 suffer from a reflected Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user-supplied input during web page generation [1]. This allows an attacker to inject arbitrary HTML and JavaScript code into the application's response.

Exploitation requires user interaction, such as clicking a specially crafted link or visiting a maliciously constructed page. The attacker does not need authentication to deliver the payload, but the target user must perform an action for the script to execute [1].

Successful exploitation enables an attacker to execute arbitrary scripts in the victim's browser, potentially leading to content injection, redirects, ad insertion, or theft of sensitive information. The injected payload is executed in the context of the vulnerable site [1].

As of the advisory, no official patch has been released for version 2.0. To mitigate the risk, users can apply a virtual patch, such as the one provided by Patchstack, to block exploitation attempts until an update becomes available [1].