CVE-2025-7726

The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via its lightbox rendering code in all versions up to, and including, 12.6.0 due to insufficient input sanitization and output escaping. The theme’s JavaScript reads user-supplied 'title' and 'data-dt-img-description' attributes directly via jQuery.attr(), concatenates them into an HTML string, and inserts that string into the DOM using methods such as jQuery.html() without escaping or filtering. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://the7.io/changelog/
• https://themeforest.net/item/the7-responsive-multipurpose-wordpress-theme/5556590
• https://themeforest.net/item/the7-responsive-multipurpose-wordpress-theme/5556590#item-description__recent-updates
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5da295f3-ac54-4330-ac39-65225adeb93a?source=cve

Published

Aug 9, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-7719Improper Limitation of a Pathname to a Restricted Directory …5.3
• CVE-2025-7721The JoomSport – for Sports: Team & League, Football, Hockey …9.8
• CVE-2025-7722The Social Streams plugin for WordPress is vulnerable to pri…8.8
• CVE-2025-7723A command injection vulnerability exists that can be exploit…8.5
• CVE-2025-7724An unauthenticated OS command injection vulnerability exists…8.7
• CVE-2025-7725The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecom…7.2
• CVE-2025-7727The Gutenverse plugin for WordPress is vulnerable to Stored …6.4
• CVE-2025-7728A vulnerability classified as problematic has been found in …5.4
• CVE-2025-7729A vulnerability classified as problematic was found in Scada…5.4
• CVE-2025-7730The Bold Page Builder plugin for WordPress is vulnerable to …6.4
• CVE-2025-7731Cleartext Transmission of Sensitive Information vulnerabilit…7.5
• CVE-2025-7732The Lazy Load for Videos plugin for WordPress is vulnerable …6.4