CVE-2025-69330

Vulnerability

Overview The Prestige WordPress theme before version 1.4.1 contains a reflected cross-site scripting (XSS) vulnerability due to improper neutralization of user-supplied input during web page generation [1]. This allows attackers to inject arbitrary JavaScript or HTML into the generated page.

Exploitation

Conditions The vulnerability is triggered when a user clicks a specially crafted link or visits a malicious page that includes a payload in a query parameter. No authentication is required from the attacker, but successful exploitation requires a privileged user (e.g., administrator) to interact with the crafted link [1]. The attack can be initiated remotely, and the user interaction is minimal.

Impact

If exploited, an attacker can execute arbitrary scripts in the context of the victim's session. This could lead to session hijacking, redirection to malicious sites, defacement, or injection of ads and other HTML payloads into the affected site [1]. The vulnerability is moderately dangerous and is expected to be used in mass-exploit campaigns targeting thousands of websites [1].

Mitigation

The vulnerability has been patched in version 1.4.1 of the theme. Users are strongly advised to update immediately. If updating is not possible, a mitigation rule from Patchstack is available to block attacks until the update is applied [1].