CVE-2025-63073
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
DOM-Based XSS vulnerability in The7 theme by Dream-Theme. Improper input neutralization during web page generation allows client-side script injection.
Risk Assessment
An attacker can execute malicious scripts in the user's browser, potentially leading to data theft, session hijacking, or content modification.
Recommendation
Update The7 theme to version 12.9.0 or later, which includes a fix for this vulnerability.
Other vulnerabilities in The7
See all- CVE-2026-66588High
The The7 theme versions up to 14.2.2 contain an unauthenticated Broken Access Control vulnerability. An attacker without logging in can gain unauthorized access to functions or data.
- CVE-2025-11897Medium
The The7 — Website and eCommerce Builder for WordPress theme is vulnerable to Stored Cross-Site Scripting via the 'the7_fancy_title_css' parameter in all versions up to, and including, 12.9.1. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dream-Theme The7 dt-the7 allows DOM-Based XSS.This issue affects The7: from n/a through < 12.9.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS