CVE-2025-69003
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-01-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| qantumthemes | kentharadio | to 2.2.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-69003 is a reflected Cross Site Scripting (XSS) vulnerability in the WordPress KenthaRadio Theme (versions up to 2.2.0). It allows attackers to inject malicious scripts, such as redirects or advertisements, that execute when visitors access the compromised site. This vulnerability falls under the OWASP Top 10 category A3: Injection and can be triggered without authentication, but exploitation depends on a privileged user interacting with malicious content like clicking a link or submitting a form. [1]
How can this vulnerability impact me? :
This vulnerability can lead to attackers executing malicious scripts on your website, potentially redirecting users to harmful sites, displaying unwanted advertisements, or stealing sensitive information. It poses a moderate risk (CVSS score 7.1) and can compromise the security and trustworthiness of your website. Exploitation requires user interaction by a privileged user, which could lead to unauthorized actions or data exposure. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves monitoring for attempts to inject malicious scripts via reflected input in the KenthaRadio theme. Since the vulnerability is a reflected XSS, you can look for suspicious HTTP requests containing script tags or typical XSS payloads in URL parameters or form submissions. Using web application firewalls (WAF) with rules targeting this vulnerability can help detect and block such attempts. Specific commands are not provided in the resources, but using tools like curl or wget to test for reflected script injection in URL parameters or employing security scanners that detect XSS vulnerabilities is recommended. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the mitigation rule issued by Patchstack to block attacks targeting this vulnerability until an official fix is released. Website owners should enable automated protection solutions provided by Patchstack to proactively secure affected sites. Since no official patch or fixed version is currently available, these mitigation rules and protective measures are the best immediate actions to prevent exploitation. [1]