Reflected Cross-site Scripting Vulnerability in Homey Theme by Favethemes

CVE-2025-31037

What is CVE-2025-31037?

The Homey theme developed by Favethemes is susceptible to a reflected cross-site scripting (XSS) vulnerability. This flaw allows attackers to inject malicious scripts into the web pages generated by the theme, impacting users’ browsers and potentially leading to unauthorized access or disclosure of sensitive information. The vulnerability affects versions from n/a up to 2.4.5, highlighting the necessity for users to update their theme to mitigate associated security risks. Proper input validation and sanitization can help prevent exploitation of this issue.

References