Stored Cross-Site Scripting in The7 WordPress Theme by Dream-Theme
CVE-2025-11897
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 25 October 2025
What is CVE-2025-11897?
The The7 — Website and eCommerce Builder for WordPress theme is vulnerable to a stored Cross-Site Scripting issue due to inadequate input sanitization and output escaping in the 'the7_fancy_title_css' parameter. This vulnerability allows authenticated users with Contributor-level access or higher to insert arbitrary web scripts into pages. When another user accesses one of these affected pages, the injected scripts can execute, potentially compromising user data and site integrity.
Affected Version(s)
The7 — Website and eCommerce Builder for WordPress * <= 12.9.1