Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddhaThemes HYDRO hydro allows Reflected XSS.This issue affects HYDRO: from n/a through <= 2.8.
Published: 2025-06-27
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability exists in the WordPress HYDRO theme, allowing an attacker to inject malicious JavaScript through unneutralized user input that is displayed back to users. This reflected XSS can be used to steal session cookies, deface content, or deliver further malware, compromising the confidentiality and integrity of visitors and potentially the site's reputation.

Affected Systems

All WordPress installations using BuddhaThemes HYDRO theme version 2.8 or earlier are susceptible. The impact is limited to sites that have the theme active and are accessible to the public.

Risk and Exploitability

The CVSS score of 7.1 classifies this as a high‑risk vulnerability; however the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires a user to visit a crafted URL that takes advantage of the theme's reflected input. The attack vector is remote, and success depends on the website rendering unescaped user data.

Generated by OpenCVE AI on May 1, 2026 at 07:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the HYDRO theme to the latest released version or remove it if no update is available.
  • Apply any vendor‑supplied patch and verify that all input rendering functions use proper escaping such as esc_html() or similar.
  • Configure a Content Security Policy that restricts script sources and mitigates the impact of any remaining XSS vectors.

Generated by OpenCVE AI on May 1, 2026 at 07:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-19277 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddhaThemes HYDRO allows Reflected XSS. This issue affects HYDRO: from n/a through 2.8.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddhaThemes HYDRO allows Reflected XSS. This issue affects HYDRO: from n/a through 2.8. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddhaThemes HYDRO hydro allows Reflected XSS.This issue affects HYDRO: from n/a through <= 2.8.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Fri, 27 Jun 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 27 Jun 2025 12:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddhaThemes HYDRO allows Reflected XSS. This issue affects HYDRO: from n/a through 2.8.
Title WordPress HYDRO theme <= 2.8 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:12:06.923Z

Reserved: 2025-03-28T11:00:15.484Z

Link: CVE-2025-31428

cve-icon Vulnrichment

Updated: 2025-06-27T12:42:58.943Z

cve-icon NVD

Status : Deferred

Published: 2025-06-27T12:15:35.643

Modified: 2026-04-23T15:27:48.527

Link: CVE-2025-31428

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-01T07:30:11Z

Weaknesses