CVE-2025-69367

WordPress Oyster - Photography WordPress Theme theme <= 4.4.3 - Cross Site Scripting (XSS) vulnerability

Published Feb 20, 2026 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3themes Oyster - Photography WordPress Theme oyster allows DOM-Based XSS.This issue affects Oyster - Photography WordPress Theme: from n/a through <= 4.4.3.

Analysis

Technical impact

The vulnerability arises from improper neutralization of user input during web page generation, enabling DOM‑Based XSS. Attackers can inject malicious scripts that run in the browser of visitors, potentially leading to defacement, phishing, or session hijacking. The flaw is identified as CWE‑79.

Affected Systems

The issue affects GT3themes’ Oyster – Photography WordPress Theme for all versions up to and including 4.4.3. Users running any of these releases are at risk.

Risk and Exploitability

With a CVSS score of 7.1 the vulnerability is moderate to high. The EPSS score is below 1%, indicating low probability of widespread exploitation, and it is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, typically via a visitor interacting with the site or submitting content through the theme’s front‑end functionality.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

GT3themes

Oyster - Photography WordPress Theme

unaffected

Version	Status	Constraints
`0`	affected	≤ 4.4.3

No data.

Vendor Product Versions

Gt3themes

Oyster - Photography Wordpress Theme

Version	Status	Scheme	Platform
`[0,4.4.3]`	affected	semver	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Oyster theme to the latest release that contains the XSS fix.
If an update is not immediately possible, disable or remove the theme functionality that accepts unescaped user input.
Implement a strict Content Security Policy that blocks inline scripts to reduce the impact if the flaw remains.

Generated by OpenCVE AI on April 27, 2026 at 20:28 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.295% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Theme/oyster/vulnerability/wordpress-oyster-photography-wordpress-theme-theme-4-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Feb 23, 2026 10:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Feb 23, 2026 3:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Gt3themes Gt3themes oyster - Photography Wordpress Theme Wordpress Wordpress wordpress
Vendors & Products		Gt3themes Gt3themes oyster - Photography Wordpress Theme Wordpress Wordpress wordpress

Feb 20, 2026 4:15 PM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3themes Oyster - Photography WordPress Theme oyster allows DOM-Based XSS.This issue affects Oyster - Photography WordPress Theme: from n/a through <= 4.4.3.
Title		WordPress Oyster - Photography WordPress Theme theme <= 4.4.3 - Cross Site Scripting (XSS) vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/Wordpress/Theme/oyster/vulnerability/wordpress-oyster-photography-wordpress-theme-theme-4-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve