Stored Cross-Site Scripting Vulnerability in Kallyas Theme for WordPress
CVE-2025-6988
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 1 November 2025
What is CVE-2025-6988?
The Kallyas Theme for WordPress has a vulnerability that allows for Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in several shortcodes. Authenticated users with contributor-level access and higher can exploit this flaw by injecting malicious scripts into pages. These scripts execute whenever a user accesses the compromised page, potentially leading to serious security ramifications.
Affected Version(s)
KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme * <= 4.23.0