CVE-2025-53229

WordPress RockON DJ theme <= 3.3 - Reflected Cross Site Scripting (XSS) vulnerability

View on CVE.org
Published Oct 22, 2025 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kamleshyadav RockON DJ rockon allows Reflected XSS.This issue affects RockON DJ: from n/a through <= 3.3.

Analysis

AI-generated

Technical impact

The CVE exposes an improper neutralization of input during page generation in the kamleshyadav RockON DJ theme, enabling attackers to inject arbitrary JavaScript through reflected Cross‑Site Scripting into pages rendered by the theme.

Affected Systems

All WordPress installations using the kamleshyadav RockON DJ theme up to and including version 3.3 are affected; earlier or newer versions are not impacted.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.1, indicating high severity, while the EPSS score of <1% suggests a low probability of widespread exploitation. Because it is a reflected XSS, an attacker must lure a user to click a crafted link or load a malicious URL; the flaw does not give the attacker direct code execution on the server but can compromise the victim’s browser. The flaw is not listed in CISA KEV, and no vendor patch is currently available.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the RockON DJ theme to a version newer than 3.3 once an update is released by the vendor.
  • If an upgrade is impossible, deactivate or delete the theme to remove the vulnerable code base.
  • Implement or strengthen a web application firewall rule that blocks or sanitizes reflected XSS payloads, or apply a strict Content Security Policy to restrict execution of injected scripts.

Generated by OpenCVE AI on April 29, 2026 at 21:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kamleshyadav RockON DJ rockon allows Reflected XSS.This issue affects RockON DJ: from n/a through <= 3.3.
Title WordPress RockON DJ theme <= 3.3 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Earlier changes (2)
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 7:11 PM
Reserved
Jun 27, 2025, 10:28 AM

View source JSON

Updated
Oct 23, 2025, 4:28 PM

JSON

Status
Deferred
Published
Oct 22, 2025, 3:15 PM
Modified
Oct 8, 2026, 11:10 AM

View source JSON

No data.

Updated
Apr 29, 2026, 9:15 PM

JSON