CVE-2025-63037: 
WordPress vulnerability analysis and mitigation

CVE-2025-63037 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the DFDevelopment Ronneby Theme Core WordPress plugin. It affects all versions of the plugin up to and including 1.5.68. The vulnerability was published on December 9, 2025, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, Patchstack).

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically manifesting as DOM-Based XSS. DOM-Based XSS occurs when client-side JavaScript dynamically writes attacker-controlled data to the DOM without proper sanitization or encoding, allowing malicious scripts to execute in the victim's browser context. Exploitation requires the attacker to have low-level privileges and requires user interaction (e.g., a victim visiting a crafted URL or page), with the scope of impact extending beyond the vulnerable component (Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session token theft, credential harvesting, defacement of web content, or redirection to malicious sites. The changed scope indicates that the impact can extend beyond the vulnerable plugin itself to affect other components of the WordPress environment or the user's browser session (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-63037 at this time. The EPSS score is approximately 0.042%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low privileges and user interaction, which somewhat limits opportunistic mass exploitation (Feedly).

Users of the Ronneby Theme Core plugin should update to a version beyond 1.5.68 if a patched release is available from DFDevelopment. In the interim, site administrators should consider disabling the plugin until a fix is confirmed, and implement a Web Application Firewall (WAF) rule to filter DOM-based XSS payloads targeting the plugin's endpoints. Monitoring browser-side JavaScript execution and reviewing plugin update channels for a patched release is strongly recommended (Patchstack).