CVE-2025-32311

The Pressroom WordPress theme, developed by QuanticaLabs, contains a reflected cross-site scripting (XSS) vulnerability in versions through 7.0. The root cause is improper neutralization of user-supplied input during web page generation, which permits the injection of arbitrary HTML and JavaScript code into the application's response [1].

Exploitation requires user interaction, such as clicking a specially crafted link or visiting a maliciously prepared page. The vulnerability can be triggered without any prior authentication, making it accessible to unauthenticated attackers [1]. Given its moderate severity (CVSS 7.1) and the potential for mass exploitation campaigns, this issue is considered dangerous for sites running the affected theme.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of a victim's browser. This could lead to redirects to malicious sites, display of unwanted advertisements, or other HTML payloads that compromise the integrity and trustworthiness of the affected website [1].

To mitigate the vulnerability, users should update Pressroom to version 7.1 or later, which contains the necessary fix. As an immediate workaround, Patchstack offers a mitigation rule that blocks attacks until the theme is updated [1]. No evidence suggests this CVE is currently listed on CISA's Known Exploited Vulnerabilities catalog, but prompt patching is strongly advised.