CVE-2025-69104
Deferred Deferred - Pending Action

Unauthenticated XSS in Qreatix <= 1.9.4

Publication date: 2026-06-17

Last updated on: 2026-06-17

Assigner: Patchstack

Description
Unauthenticated Cross Site Scripting (XSS) in Qreatix <= 1.9.4 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-17
Last Modified
2026-06-17
Generated
2026-07-07
AI Q&A
2026-06-17
EPSS Evaluated
2026-07-06
NVD
CVE-2025-69104
EUVD
EUVD-2025-210188

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
qreatix qreatix to 1.9.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WordPress Qreatix Theme, versions 1.9.4 and below, is vulnerable to an unauthenticated Cross Site Scripting (XSS) attack. This means attackers can inject malicious scripts into the website that execute when visitors access the site. Exploitation typically requires user interaction, such as clicking a malicious link or visiting a crafted page, and often involves a privileged user role. The vulnerability allows attackers to perform actions like redirects or displaying unwanted advertisements.

Impact Analysis

This vulnerability can lead to several negative impacts including unauthorized script execution on your website, which can result in redirecting visitors to malicious sites, displaying unwanted advertisements, or stealing sensitive information. Because it affects privileged user roles, it can compromise the integrity and security of your website, potentially damaging your reputation and user trust.

Detection Guidance

There is no specific detection method or commands provided in the available resources to identify this Cross Site Scripting (XSS) vulnerability in the Qreatix WordPress theme versions 1.9.4 and below.

Mitigation Strategies

Immediate mitigation steps include applying the Patchstack mitigation rule designed to block attacks exploiting this vulnerability until an official patch is released.

It is also advised to update the Qreatix theme if a newer, fixed version becomes available or seek assistance from your hosting provider or a developer to implement protective measures.

Compliance Impact

The provided information does not specify how the unauthenticated Cross Site Scripting (XSS) vulnerability in Qreatix versions 1.9.4 and below impacts compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-69104. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart