Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Modernize modernize allows Stored XSS.This issue affects Modernize: from n/a through <= 3.4.0.
Published: 2025-08-14
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an improper neutralization of input during web page generation that permits attackers to store malicious scripts within the Modernize theme. Stored XSS can lead to session hijacking, defacement, or redirection on the victim’s browser, impacting the confidentiality and integrity of user sessions.

Affected Systems

Affected are installations of the GoodLayers Modernize WordPress theme with versions up to 3.4.0, including all WordPress sites that currently use these or earlier releases of the theme.

Risk and Exploitability

The CVSS score of 6.5 signals moderate severity, while an EPSS score of <1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would need the ability to submit data through the theme’s input fields to inject script, typically via the admin interface, after which the stored payload will be rendered for any site visitor.

Generated by OpenCVE AI on April 30, 2026 at 16:08 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Search for and apply an official GoodLayers patch that addresses the XSS vulnerability; if none is available, check the vendor’s release notes for a fix.
  • If no patch is available, disable or uninstall the Modernize theme and replace it with a secure alternative.
  • Deploy a content security policy or web application firewall to block execution of unwanted scripts.

Generated by OpenCVE AI on April 30, 2026 at 16:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-24898 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Modernize allows Stored XSS. This issue affects Modernize: from n/a through 3.4.0.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Modernize allows Stored XSS. This issue affects Modernize: from n/a through 3.4.0. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Modernize modernize allows Stored XSS.This issue affects Modernize: from n/a through <= 3.4.0.
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Fri, 15 Aug 2025 08:15:00 +0000

Type Values Removed Values Added
First Time appeared Goodlayers
Goodlayers modernize
Wordpress
Wordpress wordpress
Vendors & Products Goodlayers
Goodlayers modernize
Wordpress
Wordpress wordpress

Thu, 14 Aug 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 14 Aug 2025 18:30:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Modernize allows Stored XSS. This issue affects Modernize: from n/a through 3.4.0.
Title WordPress Modernize Theme <= 3.4.0 - Cross Site Scripting (XSS) Vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Goodlayers Modernize
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:13:24.044Z

Reserved: 2025-06-27T11:59:29.326Z

Link: CVE-2025-53342

cve-icon Vulnrichment

Updated: 2025-08-14T20:04:07.263Z

cve-icon NVD

Status : Deferred

Published: 2025-08-14T19:15:35.800

Modified: 2026-04-23T15:32:31.683

Link: CVE-2025-53342

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-30T16:15:06Z

Weaknesses