CVE-2025-63073

MediumCVSS 6.5

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

DOM-Based XSS vulnerability in The7 theme by Dream-Theme. Improper input neutralization during web page generation allows client-side script injection.

Risk Assessment

An attacker can execute malicious scripts in the user's browser, potentially leading to data theft, session hijacking, or content modification.

Recommendation

Update The7 theme to version 12.9.0 or later, which includes a fix for this vulnerability.

Other vulnerabilities in The7

CVE-2025-11897Medium
The The7 — Website and eCommerce Builder for WordPress theme is vulnerable to Stored Cross-Site Scripting via the 'the7_fancy_title_css' parameter in all versions up to, and including, 12.9.1. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dream-Theme The7 dt-the7 allows DOM-Based XSS.This issue affects The7: from n/a through < 12.9.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS