CVE-2025-58020
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The Theater for WordPress plugin (versions up to 0.18.8) is vulnerable to stored XSS due to improper input neutralization during web page generation. Attackers can inject malicious scripts.
Risk Assessment
Attackers can inject malicious scripts that execute in users' browsers, potentially leading to data theft or session hijacking.
Recommendation
Update the Theater for WordPress plugin to the latest version that includes a security fix.
Other vulnerabilities in Theater for WordPress
See all- CVE-2025-69331Medium
The Theater for WordPress plugin (versions up to and including 0.19) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This allows exploitation of improperly configured authorization mechanisms.
- CVE-2025-64259Medium
The Theater for WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 0.18.8.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Schmit Theater for WordPress theatre allows Stored XSS.This issue affects Theater for WordPress: from n/a through <= 0.18.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS