CVE-2025-69154

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in the SpaLab Beauty Salon WordPress Theme version 6.7 and earlier. It allows a remote attacker to inject malicious JavaScript code without authentication.

An attacker can exploit this vulnerability to steal user sessions, redirect to malicious sites, or exfiltrate sensitive data, compromising the security of website visitors.

Immediately update the Beauty Salon theme to the latest available version that fixes this vulnerability. If an update is not possible, consider temporarily disabling the theme or deploying a web application firewall (WAF).