CVE-2025-27014

CVE-2025-27014 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-Site Scripting (XSS, CWE-79), affecting the Hostiko WordPress theme developed by designingmedia. The issue impacts all versions of Hostiko from n/a through those prior to 30.1. Published on 2025-03-26, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility, low attack complexity, no required privileges, user interaction, and changed scope with low impacts on confidentiality, integrity, and availability.

Attackers can exploit this vulnerability remotely without authentication by crafting malicious input that reflects unsanitized back into a web page generated by the Hostiko theme. This requires tricking a user—such as a site visitor or administrator—into interacting with a malicious link or payload via social engineering, like phishing. Successful exploitation executes arbitrary JavaScript in the victim's browser context, potentially leading to session hijacking, theft of sensitive data like cookies or tokens, or minor disruptions, though impacts remain low per the CVSS metrics.

Patchstack advisories detail the vulnerability and recommend updating the Hostiko WordPress theme to version 30.1 or later, where the XSS flaw is addressed. No additional workarounds are specified in available references.