Stored Cross-Site Scripting Flaw in Appzend Theme for WordPress
CVE-2025-5587

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Appzend
Vendor
CVE Published:
29 July 2025

What is CVE-2025-5587?

The Appzend theme for WordPress has a vulnerability that allows authenticated attackers, with Contributor-level access and above, to exploit a Stored Cross-Site Scripting (XSS) weakness through the 'progressbarLayout' parameter. This occurs due to inadequate input sanitization and output escaping measures in versions up to and including 1.2.6. Upon successful exploitation, attackers can inject arbitrary web scripts that will run when users access compromised pages, potentially leading to serious security and privacy implications.

Affected Version(s)

Appzend * <= 1.2.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://themes.trac.wordpress.org/browser/appzend/1.2.6/b...
https://wordpress.org/themes/appzend/

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Thaleikis
.
CVE-2025-5587 : Stored Cross-Site Scripting Flaw in Appzend Theme for WordPress