PT-2025-43282 · Amentotech · Doctreat

Published 2025-10-22 · Updated 2025-11-18 · CVE-2025-58971

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions AmentoTech Doctreat versions through 1.6.7

Description The software contains a flaw due to improper neutralization of input during web page generation, leading to a Reflected Cross-Site Scripting (XSS) condition. This allows an attacker to inject malicious scripts into web pages viewed by other users. The vulnerability exists because the application does not properly sanitize user-supplied input before including it in the generated web page. This can lead to the execution of arbitrary JavaScript code in the context of the user's browser. The affected application does not have any specific API endpoints or vulnerable parameters mentioned in the description.

Recommendations Versions prior to and including 1.6.7 should be updated to a newer, secure version when available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-58971

Affected Products

Doctreat

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-58971 · Security Note
• https://vdp.patchstack.com/database/Wordpress/Theme/doctreat/vulnerability/wordpress-doctreat-theme-1-6-7-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1990786260869201978 · Twitter Post
• https://patchstack.com/database/Wordpress/Theme/doctreat/vulnerability/wordpress-doctreat-theme-1-6-7-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://vdp.patchstack.com/database/Wordpress/Theme/doctreat/vulnerability/wordpress-doctreat-theme-1-6-7-cross-site-scripting-xss-vulnerability · Note