CVE-2025-46494
Reflected XSS in Themesgrove WidgetKit Pro
Publication date: 2026-01-07
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| themesgrove | widgetkit_pro | From 1.0.0 (inc) to 1.13.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Reflected Cross-site Scripting (XSS) issue in Themesgrove WidgetKit Pro. It occurs due to improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that are reflected back to users.
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute malicious scripts in the context of a user's browser, potentially leading to theft of sensitive information, session hijacking, or other malicious actions. It can impact confidentiality, integrity, and availability of data.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves monitoring for reflected XSS attack patterns, such as unexpected script injections in URL parameters or form inputs. Since no official detection commands are provided, you can use web vulnerability scanners that support XSS detection or manually test by injecting typical XSS payloads in input fields and observing if they are reflected unsanitized in the response. Additionally, monitoring web server logs for suspicious requests containing script tags or encoded payloads may help identify exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the Patchstack mitigation rule designed to block attacks targeting this vulnerability until an official patch is released. Users should avoid clicking suspicious links and restrict user interactions that could trigger the vulnerability. Since no official fix is available yet, applying this mitigation and monitoring for suspicious activity are critical to reduce risk. [1]