Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core Features designthemes-core-features allows Reflected XSS.This issue affects DesignThemes Core Features: from n/a through <= 2.3.
Published: 2026-02-20
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Reflected Cross‑Site Scripting
Action: Patch
AI Analysis

Impact

Improper neutralization of input during web page generation, reflected use of user data without proper escaping, leads to a Cross‑Site Scripting (XSS) flaw in the DesignThemes Core Features plugin for WordPress. Attackers can inject malicious scripts into pages viewed by other users, enabling theft of session tokens, data exfiltration, or defacement.

Affected Systems

The vulnerability is present in the DesignThemes Core Features WordPress plugin, version 2.3 and earlier. It affects all installations of the plugin up to and including 2.3. No other versions were listed as affected.

Risk and Exploitability

The CVSS score is 7.1 indicating a high potential for exploitation. EPSS is less than 1%, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is reflected XSS via plugin input fields or query parameters, inferred from the described lack of proper neutralization.

Generated by OpenCVE AI on April 27, 2026 at 20:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the DesignThemes Core Features plugin to a version newer than 2.3, which incorporates the XSS fix.
  • If an update cannot be applied immediately, disable or deactivate the DesignThemes Core Features plugin to remove the vulnerability until a patch is available.
  • Apply strict input validation and output escaping on any plugin‑controlled content, or deploy a web application firewall rule that blocks reflected XSS payloads.

Generated by OpenCVE AI on April 27, 2026 at 20:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 23 Feb 2026 22:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 23 Feb 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Designthemes
Designthemes designthemes Core Features
Wordpress
Wordpress wordpress
Vendors & Products Designthemes
Designthemes designthemes Core Features
Wordpress
Wordpress wordpress

Fri, 20 Feb 2026 16:15:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core Features designthemes-core-features allows Reflected XSS.This issue affects DesignThemes Core Features: from n/a through <= 2.3.
Title WordPress DesignThemes Core Features plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References

Subscriptions

Designthemes Designthemes Core Features
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T20:46:42.748Z

Reserved: 2025-12-31T20:12:02.741Z

Link: CVE-2025-69302

cve-icon Vulnrichment

Updated: 2026-02-23T21:37:20.474Z

cve-icon NVD

Status : Deferred

Published: 2026-02-20T16:22:18.030

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-69302

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-27T20:45:12Z

Weaknesses