CVE-2025-11897
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The The7 — Website and eCommerce Builder for WordPress theme is vulnerable to Stored Cross-Site Scripting via the 'the7_fancy_title_css' parameter in all versions up to, and including, 12.9.1. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts.
Risk Assessment
Injected scripts can execute in users' browsers, potentially leading to data theft, session hijacking, or malware distribution.
Recommendation
Update the The7 theme to the latest patched version. Restrict account privileges and regularly audit content for suspicious scripts.
Other vulnerabilities in The7
See all- CVE-2026-66588High
The The7 theme versions up to 14.2.2 contain an unauthenticated Broken Access Control vulnerability. An attacker without logging in can gain unauthorized access to functions or data.
- CVE-2025-63073Medium
DOM-Based XSS vulnerability in The7 theme by Dream-Theme. Improper input neutralization during web page generation allows client-side script injection.
Original NVD description (English source)
The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ the7_fancy_title_css’ parameter in all versions up to, and including, 12.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS