CVE-2025-12116
Stored XSS in Drift WordPress Theme Post Titles Allows Script Injection
Publication date: 2026-02-19
Last updated on: 2026-02-19
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| thinkupthemes | drift | to 1.5.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Drift theme for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 1.5.0. This vulnerability arises because the theme does not properly sanitize or escape input in the post title. As a result, authenticated users with Contributor-level access or higher can inject malicious scripts into post titles. These scripts then execute whenever any user views the affected page.
How can this vulnerability impact me? :
This vulnerability allows attackers with Contributor-level access or above to inject arbitrary web scripts into post titles. When other users visit pages with these injected titles, the malicious scripts execute in their browsers. This can lead to unauthorized actions such as stealing user credentials, hijacking user sessions, defacing the website, or performing other malicious activities that compromise the integrity and security of the site.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The vulnerability exists in all versions of the Drift WordPress theme up to and including 1.5.0 due to insufficient input sanitization and output escaping in the post title, allowing stored cross-site scripting by authenticated users with Contributor-level access and above.
To mitigate this vulnerability, the immediate step is to update the Drift theme to a version later than 1.5.0 where the issue is fixed. If an update is not available, restrict Contributor-level access and above to trusted users only, and consider applying custom input sanitization or output escaping patches to the theme code.