CVE-2025-49893

Vulnerability

The Nuss theme for WordPress versions from n/a through 1.3.3 contains a reflected cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The vulnerability is classified as CWE-79 and allows an attacker to inject arbitrary HTML and JavaScript into the page output [1].

Exploitation

Exploitation requires user interaction, such as clicking a specially crafted link or visiting a maliciously prepared page. An unauthenticated attacker can craft a URL that, when visited by a victim (including privileged users), causes the injected script to execute in the context of the victim's browser session [1].

Impact

Successful exploitation can lead to a range of malicious activities, including redirecting visitors to arbitrary sites, displaying unauthorized advertisements, stealing cookies or session tokens, and potentially performing actions on behalf of the victim if they have appropriate privileges [1].

Mitigation

The vendor has not yet released an official patch, but Patchstack has provided a virtual mitigation rule to block attacks until a proper fix is available. Users are advised to update the theme as soon as a patched version is released or apply the available mitigation [1].