CVE-2025-69104
Deferred Deferred - Pending Action
Unauthenticated XSS in Qreatix <= 1.9.4

Publication date: 2026-06-17

Last updated on: 2026-06-17

Assigner: Patchstack

Description
Unauthenticated Cross Site Scripting (XSS) in Qreatix <= 1.9.4 versions.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-17
Last Modified
2026-06-17
Generated
2026-06-17
AI Q&A
2026-06-17
EPSS Evaluated
N/A
NVD
CVE-2025-69104
EUVD
EUVD-2025-210188
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
qreatix qreatix to 1.9.4 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The WordPress Qreatix Theme, versions 1.9.4 and below, is vulnerable to an unauthenticated Cross Site Scripting (XSS) attack. This means attackers can inject malicious scripts into the website that execute when visitors access the site. Exploitation typically requires user interaction, such as clicking a malicious link or visiting a crafted page, and often involves a privileged user role. The vulnerability allows attackers to perform actions like redirects or displaying unwanted advertisements.

Impact Analysis

This vulnerability can lead to several negative impacts including unauthorized script execution on your website, which can result in redirecting visitors to malicious sites, displaying unwanted advertisements, or stealing sensitive information. Because it affects privileged user roles, it can compromise the integrity and security of your website, potentially damaging your reputation and user trust.

Detection Guidance

There is no specific detection method or commands provided in the available resources to identify this Cross Site Scripting (XSS) vulnerability in the Qreatix WordPress theme versions 1.9.4 and below.

Mitigation Strategies

Immediate mitigation steps include applying the Patchstack mitigation rule designed to block attacks exploiting this vulnerability until an official patch is released.

It is also advised to update the Qreatix theme if a newer, fixed version becomes available or seek assistance from your hosting provider or a developer to implement protective measures.

Compliance Impact

The provided information does not specify how the unauthenticated Cross Site Scripting (XSS) vulnerability in Qreatix versions 1.9.4 and below impacts compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-69104. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart