Cross-Site Scripting Vulnerability in SmartMag Theme by ThemeSphere
CVE-2025-64204

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Smartmag
Vendor
CVE Published:
29 October 2025

What is CVE-2025-64204?

A Cross-Site Scripting (XSS) vulnerability in the SmartMag theme developed by ThemeSphere allows attackers to inject malicious scripts into web pages. This stored XSS vulnerability affects versions from n/a up to and including 10.3.1, compromising the security of applications using this theme. As a result, attackers may exploit the vulnerability to execute arbitrary scripts in users' browsers, potentially leading to stolen cookies, session hijacking, or redirection to malicious websites. It is crucial for users of the SmartMag theme to apply necessary updates or patches to mitigate this security risk.

Affected Version(s)

SmartMag <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Theme/smart...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro S Alcântara (Kinorth) | Patchstack Bug Bounty Program
JSON
.