CVE-2025-7726

Vulnerability

Overview

The7 theme for WordPress, up to version 12.6.0, contains a stored cross-site scripting (XSS) vulnerability in its lightbox rendering code. The theme's JavaScript reads user-supplied title and data-dt-img-description attributes directly via jQuery.attr(), concatenates them into an HTML string, and inserts that string into the DOM using methods such as jQuery.html() without escaping or filtering. This lack of input sanitization and output escaping allows attackers to inject malicious scripts.

Exploitation

Prerequisites

An attacker must be authenticated with at least Contributor-level access to WordPress. They can craft a post or page containing a lightbox element with malicious title or data-dt-img-description attributes. When any user (including administrators) views the compromised page, the injected script executes in the context of the victim's browser.

Impact

Successful exploitation enables arbitrary JavaScript execution, which can be leveraged to steal session cookies, redirect users to malicious sites, deface pages, or perform other client-side attacks. The vulnerability affects any site using the The7 theme up to version 12.6.0.

Mitigation

The The7 theme's changelog indicates that security fixes were applied in later versions [1]. Users are strongly advised to update to the latest available version of the theme. No workaround is documented; updating is the recommended remediation.