CVE-2025-27014

High

Published: 26 March 2025

Published

26 March 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0111 78.5th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-27014 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-27014 is a reflected cross-site scripting vulnerability arising from improper neutralization of input during web page generation. It affects the Hostiko WordPress theme by designingmedia in all versions through 30.0.

An unauthenticated remote attacker can supply a crafted URL that, when visited by a user, executes arbitrary script in the victim's browser context. The CVSS vector indicates network attack vector, low complexity, no required privileges, and required user interaction, resulting in limited impacts to confidentiality, integrity, and availability with a changed scope.

The Patchstack advisory identifies the flaw in Hostiko and indicates that version 30.1 addresses the issue. The associated EPSS score remains low and unchanged at 0.0111 with no material increase after disclosure.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-8218

Vulnerability details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designingmedia Hostiko hostiko allows Reflected XSS.This issue affects Hostiko: from n/a through < 30.1.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1566.002 Spearphishing Link Initial Access

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.

attack.mitre.org →

T1204.001 Malicious Link Execution

An adversary may rely upon a user clicking a malicious link in order to gain execution.

attack.mitre.org →

Why these techniques?

Reflected XSS in public-facing WordPress theme directly enables T1190 (exploit public-facing application) and is exploited via malicious links (T1204.001) typically delivered as spearphishing (T1566.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0