CVE-2025-64207: 
WordPress vulnerability analysis and mitigation

CVE-2025-64207 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the TieLabs Jannah WordPress theme affecting all versions up to and including 7.6.0. The vulnerability was reported by researcher João Pedro S Alcântara (Kinorth) on September 29, 2025, and published by Patchstack on October 29, 2025. It carries a CVSS v3.1 base score of 7.1 (Medium/High), requiring no authentication but necessitating user interaction for exploitation (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically manifesting as DOM-Based XSS, meaning malicious payloads are processed and executed entirely within the browser's DOM without necessarily being reflected from the server (Patchstack). The attack vector is network-based, requires no privileges, and has low attack complexity, but does require a victim user to interact with a crafted link or page. The scope is changed, meaning the injected script can affect resources beyond the vulnerable component itself, such as the victim's browser session and any data accessible within it.

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, redirection to malicious sites, and defacement of web content visible to site visitors. Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or traffic (Patchstack).

No public proof-of-concept exploit code has been identified at this time, and there is no confirmed evidence of active in-the-wild exploitation. The EPSS score is approximately 0.029% (0.000290), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as medium priority and warns it is expected to be exploited, consistent with the pattern of mass-exploit campaigns targeting WordPress themes (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Jannah theme version 7.6.0 or earlier using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/themes/jannah).
2. Identify vulnerable DOM sink: Analyze the Jannah theme's JavaScript code to locate DOM-based XSS sinks where user-controlled input (e.g., URL fragments or query parameters) is written to the DOM without sanitization.
3. Craft malicious URL: Construct a URL targeting the vulnerable site that includes a malicious JavaScript payload in the DOM-controllable input (e.g., a URL fragment #<img src=x onerror=alert(document.cookie)> or similar).
4. Deliver payload: Send the crafted URL to a target victim (e.g., a site administrator) via phishing email, social engineering, or embedding in a malicious page.
5. Achieve objective: When the victim clicks the link and their browser processes the DOM, the injected script executes in the context of the victim's session, enabling cookie theft, session hijacking, or further malicious actions (Patchstack).

• Network: Unusual inbound requests to Jannah-themed WordPress pages containing encoded JavaScript payloads in URL parameters or fragments (e.g., <script>, onerror=, javascript: patterns in access logs).
• Logs: Web server access logs showing requests with suspicious URL-encoded characters (%3Cscript%3E, %22, %27) in query strings or hash fragments targeting Jannah theme pages.
• Browser/Client-Side: Victim browsers making unexpected outbound requests to attacker-controlled domains following interaction with a crafted link (observable via network monitoring or endpoint detection tools).
• File System: Unexpected modifications to Jannah theme JavaScript files that could indicate a secondary payload delivery stage following initial XSS exploitation.

The vendor TieLabs has released Jannah version 7.6.1, which patches this vulnerability. All users running Jannah version 7.6.0 or earlier should update to version 7.6.1 or later immediately. As an interim measure, Patchstack offers a virtual patching/mitigation rule that blocks exploitation attempts until the theme can be updated. Site administrators unable to update immediately should consult their hosting provider or web developer for assistance (Patchstack).

The vulnerability was discovered and disclosed through Patchstack's coordinated vulnerability disclosure program, with researcher João Pedro S Alcântara (Kinorth) credited for the report. Patchstack has flagged it as a medium-priority issue expected to be targeted in mass-exploit campaigns, consistent with broader trends in WordPress theme vulnerabilities. No notable independent researcher commentary or significant media coverage beyond the Patchstack advisory has been identified (Patchstack).