Stored Cross-Site Scripting Vulnerability in Theater Plugin for WordPress
CVE-2025-58020

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Theater For WordPress
Vendor
CVE Published:
22 September 2025

What is CVE-2025-58020?

A vulnerability has been identified in the Theater plugin for WordPress, where improper neutralization of user input during web page generation can lead to Stored Cross-Site Scripting (XSS). This flaw can allow attackers to inject malicious scripts into web pages viewed by other users, potentially compromising their accounts or sensitive data. Affected versions include Theater for WordPress from the start through 0.18.8. Website administrators should update their plugins promptly to safeguard against these attacks.

Affected Version(s)

Theater for WordPress <= 0.18.8

References

https://patchstack.com/database/wordpress/plugin/theatre/...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Yudha - DJ (Patchstack Alliance)
JSON
.