CVE-2025-5587

The Appzend WordPress theme, up to version 1.2.6, contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'progressbarLayout' parameter. The issue arises from insufficient input sanitization and output escaping, allowing user-supplied input to be stored and later executed in the browser of any user viewing the affected page.

An attacker must have at least Contributor-level access to exploit this vulnerability. By injecting malicious JavaScript code into the 'progressbarLayout' parameter, the script becomes stored in the database and executes whenever a victim accesses the compromised page.

Successful exploitation can lead to arbitrary script execution in the context of the victim's session, potentially allowing sensitive information disclosure, session hijacking, or defacement of the site. As of the publication date, users are advised to update to a patched version if available or apply necessary sanitization measures.

The Appzend theme is available from the WordPress theme directory and has over 100 active installations [1].