CVE-2025-58920
Published: 10 April 2026
Summary
CVE-2025-58920 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates identifying, prioritizing, and remediating the specific reflected XSS flaw in the vulnerable Cerato WordPress theme versions.
Requires filtering of web page outputs to neutralize untrusted input reflected during page generation, preventing JavaScript execution.
Enforces validation of user inputs to reject or sanitize malicious payloads that could lead to reflected XSS exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress theme directly enables remote exploitation of the web application (T1190) via crafted malicious links requiring user interaction (T1204.001, T1566.002) to trigger arbitrary JS execution in the browser.
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zootemplate Cerato cerato allows Reflected XSS.This issue affects Cerato: from n/a through <= 2.2.18.
Deeper analysisAI
CVE-2025-58920 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Zootemplate Cerato WordPress theme. This issue affects Cerato versions from n/a through 2.2.18 inclusive. The vulnerability was published on 2026-04-10 and carries a CVSS v3.1 base score of 7.1.
The vulnerability can be exploited remotely over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R), such as a victim visiting a maliciously crafted webpage or clicking a link. Exploitation changes scope (S:C), enabling limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), typically allowing arbitrary JavaScript execution in the victim's browser context.
Patchstack's advisory documents this Reflected XSS vulnerability specifically in WordPress Cerato theme version 2.2.18 and provides vulnerability details in their database.
Details
- CWE(s)