CVE-2025-54055

Vulnerability

Description

The Druco WordPress theme versions up to and including 1.5.2 are vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user input during web page generation [1]. This flaw allows an attacker to inject arbitrary HTML and JavaScript code into the output.

Exploitation

Details

Exploitation requires user interaction, such as clicking a malicious link or visiting a crafted page. The attacker does not need prior authentication, and the vulnerability can be triggered by any privileged user who performs the action [1]. This type of vulnerability is commonly used in mass-exploit campaigns targeting thousands of websites regardless of popularity.

Impact

Successful exploitation allows an attacker to execute malicious scripts in the context of the victim's browser. This can lead to redirects, advertisements, or other HTML payloads being displayed to site visitors [1].

Mitigation

The vendor has released version 1.5.3 which resolves the vulnerability. Users are strongly advised to update to the latest version. For those unable to update immediately, a mitigation rule is available from Patchstack to block attacks until the update is applied [1].