PT-2025-52166 · Unknown · Themegoods Photography

João Pedro S Alcântara + 1 · Published 2025-12-18 · Updated 2025-12-18 · CVE-2025-64217

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions ThemeGoods Photography versions through 7.7.2

Description The software contains a flaw related to improper input handling during web page generation, specifically a Reflected Cross-Site Scripting (XSS) issue. This allows for the execution of malicious scripts within the application. The vulnerable component is susceptible to attacks where crafted input can be injected into web pages, potentially compromising user data or system integrity. The vulnerable parameter is not specified.

Recommendations Update ThemeGoods Photography to a version newer than 7.7.2.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-64217

Affected Products

Themegoods Photography

References · 5

• https://osv.dev/vulnerability/CVE-2025-64217 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64217 · Security Note
• https://patchstack.com/database/Wordpress/Theme/photography/vulnerability/wordpress-photography-theme-7-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2001736589135712447 · Twitter Post
• https://vdp.patchstack.com/database/Wordpress/Theme/photography/vulnerability/wordpress-photography-theme-7-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve · Note