Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kamleshyadav RockON DJ rockon allows Reflected XSS.This issue affects RockON DJ: from n/a through <= 3.3.
Published: 2025-10-22
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The CVE exposes an improper neutralization of input during page generation in the kamleshyadav RockON DJ theme, enabling attackers to inject arbitrary JavaScript through reflected Cross‑Site Scripting into pages rendered by the theme.

Affected Systems

All WordPress installations using the kamleshyadav RockON DJ theme up to and including version 3.3 are affected; earlier or newer versions are not impacted.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.1, indicating high severity, while the EPSS score of <1% suggests a low probability of widespread exploitation. Because it is a reflected XSS, an attacker must lure a user to click a crafted link or load a malicious URL; the flaw does not give the attacker direct code execution on the server but can compromise the victim’s browser. The flaw is not listed in CISA KEV, and no vendor patch is currently available.

Generated by OpenCVE AI on April 29, 2026 at 21:01 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the RockON DJ theme to a version newer than 3.3 once an update is released by the vendor.
  • If an upgrade is impossible, deactivate or delete the theme to remove the vulnerable code base.
  • Implement or strengthen a web application firewall rule that blocks or sanitizes reflected XSS payloads, or apply a strict Content Security Policy to restrict execution of injected scripts.

Generated by OpenCVE AI on April 29, 2026 at 21:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
References

Thu, 13 Nov 2025 11:30:00 +0000

Type Values Removed Values Added
References

Thu, 13 Nov 2025 10:45:00 +0000

Type Values Removed Values Added
References

Thu, 23 Oct 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 23 Oct 2025 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Wed, 22 Oct 2025 14:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kamleshyadav RockON DJ rockon allows Reflected XSS.This issue affects RockON DJ: from n/a through <= 3.3.
Title WordPress RockON DJ theme <= 3.3 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T19:11:24.786Z

Reserved: 2025-06-27T10:28:03.500Z

Link: CVE-2025-53229

cve-icon Vulnrichment

Updated: 2025-10-23T16:28:07.486Z

cve-icon NVD

Status : Deferred

Published: 2025-10-22T15:15:48.157

Modified: 2026-06-17T09:37:50.413

Link: CVE-2025-53229

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-29T21:15:16Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')