Cross-site Scripting Vulnerability in ThemeGoods Grand Conference Theme
CVE-2025-64224

7.1HIGH

Key Information:

Vendor

WordPress
Status
Grand Conference Theme Custom Post Type
Vendor
CVE Published:
6 November 2025

What is CVE-2025-64224?

The ThemeGoods Grand Conference Theme Custom Post Type has been identified with a Cross-site Scripting (XSS) vulnerability that enables attackers to inject malicious scripts. This issue primarily affects users of versions prior to 2.6.4, potentially allowing for reflected XSS attacks when data isn't properly neutralized during web page generation. Malicious actors could exploit this flaw to execute harmful scripts in the context of users' browsers, compromising their sessions or stealing sensitive information.

Affected Version(s)

Grand Conference Theme Custom Post Type <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Plugin/gran...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bonds | Patchstack Bug Bounty Program
JSON
.
CVE-2025-64224 : Cross-site Scripting Vulnerability in ThemeGoods Grand Conference Theme