CVE-2025-67618
Reflected XSS in ArtstudioWorks Brookside up to
Publication date: 2026-03-19
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| artstudioworks | brookside | From 1.0 (inc) to 1.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-67618 is a Cross Site Scripting (XSS) vulnerability affecting the WordPress Brookside Theme versions up to and including 1.4.
This vulnerability allows attackers to inject malicious scripts—such as redirects, advertisements, or other HTML payloads—into websites using the affected theme.
These malicious scripts execute when visitors access the compromised site, potentially leading to widespread exploitation.
The vulnerability is classified under OWASP Top 10 A3: Injection and has a CVSS score of 7.1, indicating moderate severity.
Exploitation does not require authentication but does require a privileged user to perform an action like clicking a malicious link, visiting a crafted page, or submitting a form.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability can lead to attackers injecting and executing malicious scripts on your website, which can cause several harmful effects.'}, {'type': 'list_item', 'content': 'Redirecting visitors to malicious or phishing sites.'}, {'type': 'list_item', 'content': 'Displaying unwanted advertisements or malicious content.'}, {'type': 'list_item', 'content': 'Stealing sensitive information from users through script execution.'}, {'type': 'paragraph', 'content': "Such exploitation can damage your website's reputation, compromise user data, and potentially lead to further security breaches."}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is a reflected Cross Site Scripting (XSS) issue in the WordPress Brookside Theme up to version 1.4. Detection typically involves monitoring for unusual or malicious script injections in web requests or responses related to the affected theme.
Since no official patch is available, detection can be aided by applying mitigation rules from Patchstack that block attacks targeting this vulnerability.
Specific commands are not provided in the available resources, but common approaches include using web vulnerability scanners or manual inspection of HTTP requests and responses for suspicious script payloads in URLs, forms, or headers related to the Brookside theme.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the mitigation rule issued by Patchstack to block attacks targeting this vulnerability until an official patch is released.
Users are advised to implement this mitigation immediately or seek assistance from their hosting provider or web developer to apply the necessary protections.
Additionally, exercising caution by limiting privileged user interactions with untrusted links or pages can reduce the risk of exploitation.