CVE-2025-63061
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The KALLYAS theme (versions below 4.25.0) contains a DOM-Based Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. A malicious script can be executed in the user's browser through DOM manipulation.
Risk Assessment
An attacker could exploit the vulnerability to execute a malicious script in the user's browser, potentially leading to session theft or account takeover. The risk is particularly relevant for administrators visiting affected pages.
Recommendation
Update the KALLYAS theme to version 4.25.0 or later. Until then, avoid visiting untrusted sites using this theme.
Other vulnerabilities in KALLYAS
See all- CVE-2025-63060Medium
The KALLYAS plugin (by hogash) is vulnerable to Cross-Site Request Forgery (CSRF). This issue affects KALLYAS versions from n/a through < 4.25.0.
- CVE-2025-62018Medium
Missing Authorization vulnerability in hogash KALLYAS kallyas. This issue affects KALLYAS from n/a through <= 4.22.0.
- CVE-2025-62017Medium
The KALLYAS theme for WordPress is vulnerable to missing authorization in versions up to and including 4.22.0. This vulnerability may allow unauthorized access to functions or data.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hogash KALLYAS kallyas allows DOM-Based XSS.This issue affects KALLYAS: from n/a through < 4.25.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS