Cyber Resilience

CVE-2025-67959

High

Published: 22 January 2026

Published
22 January 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0006 20.3th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-67959 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 20.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-67959 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the purethemes WorkScout WordPress theme. This issue affects WorkScout versions from n/a through <= 4.1.07. The vulnerability was published on 2026-01-22T17:16:05.513 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Attackers can exploit this vulnerability remotely over the network with low complexity and no required privileges, though it requires user interaction such as clicking a malicious link. Upon successful exploitation, adversaries achieve low impacts on confidentiality, integrity, and availability, with a changed scope that may affect other users or the application's security context, such as session hijacking or data theft from the interacting user.

The Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/workscout/vulnerability/wordpress-workscout-theme-4-1-07-cross-site-scripting-xss-vulnerability?_s_id=cve) documents the Reflected XSS flaw in WorkScout theme version 4.1.07 and provides details relevant to mitigation for WordPress environments.

EU & UK References

Vulnerability details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout workscout allows Reflected XSS.This issue affects WorkScout: from n/a through <= 4.1.07.

CWE(s)
CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
attack.mitre.org →
Why these techniques?

Reflected XSS directly enables browser session hijacking and client-side data theft via malicious link as described.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-25203Shared CWE-79
CVE-2025-68835Shared CWE-79
CVE-2026-32118Shared CWE-79
CVE-2025-24617Shared CWE-79
CVE-2026-30934Shared CWE-79
CVE-2026-24833Shared CWE-79
CVE-2024-56038Shared CWE-79
CVE-2025-25823Shared CWE-79
CVE-2025-36548Shared CWE-79
CVE-2025-69392Shared CWE-79

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Requires validation and neutralization of untrusted input parameters before they are used in web page generation, directly blocking the reflected XSS payload.

SI-15 Information Output Filtering good match
prevent

Mandates filtering or encoding of information sent to users, preventing malicious script from being reflected in HTTP responses.

SC-7 Boundary Protection partial match
prevent

Boundary protection devices such as WAFs can inspect and drop requests containing reflected XSS patterns before they reach the vulnerable theme code.

References