CVE-2025-69302

WordPress DesignThemes Core Features plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Published Feb 20, 2026 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core Features designthemes-core-features allows Reflected XSS.This issue affects DesignThemes Core Features: from n/a through <= 2.3.

Analysis

Technical impact

Improper neutralization of input during web page generation, reflected use of user data without proper escaping, leads to a Cross‑Site Scripting (XSS) flaw in the DesignThemes Core Features plugin for WordPress. Attackers can inject malicious scripts into pages viewed by other users, enabling theft of session tokens, data exfiltration, or defacement.

Affected Systems

The vulnerability is present in the DesignThemes Core Features WordPress plugin, version 2.3 and earlier. It affects all installations of the plugin up to and including 2.3. No other versions were listed as affected.

Risk and Exploitability

The CVSS score is 7.1 indicating a high potential for exploitation. EPSS is less than 1%, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is reflected XSS via plugin input fields or query parameters, inferred from the described lack of proper neutralization.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

designthemes

DesignThemes Core Features

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.3

No data.

Vendor Product Versions

Designthemes

Designthemes Core Features

Version	Status	Scheme	Platform
`[0,2.3]`	affected	generic	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the DesignThemes Core Features plugin to a version newer than 2.3, which incorporates the XSS fix.
If an update cannot be applied immediately, disable or deactivate the DesignThemes Core Features plugin to remove the vulnerability until a patch is available.
Apply strict input validation and output escaping on any plugin‑controlled content, or deploy a web application firewall rule that blocks reflected XSS payloads.

Generated by OpenCVE AI on April 27, 2026 at 20:37 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.221% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/designthemes-core-features/vulnerability/wordpress-designthemes-core-features-plugin-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Feb 23, 2026 10:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Feb 23, 2026 3:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Designthemes Designthemes designthemes Core Features Wordpress Wordpress wordpress
Vendors & Products		Designthemes Designthemes designthemes Core Features Wordpress Wordpress wordpress

Feb 20, 2026 4:15 PM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core Features designthemes-core-features allows Reflected XSS.This issue affects DesignThemes Core Features: from n/a through <= 2.3.
Title		WordPress DesignThemes Core Features plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/Wordpress/Plugin/designthemes-core-features/vulnerability/wordpress-designthemes-core-features-plugin-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve