CVE-2025-53585: WordPress WeMusic theme <= 1.9.1 - Cross Site Scripting (XSS) vulnerability
Published Nov 6, 2025
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme WeMusic noo-wemusic allows Reflected XSS.This issue affects WeMusic: from n/a through <= 1.9.1.
Affected Software
2 affected components
NooTheme WeMusic<=1.9.1
WordPress WeMusic<=1.9.1
Event History
Nov 6, 2025
CVE Published
via MITRE·03:54 PM
Data Sourced
via MITRE·03:54 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-53585?
CVE-2025-53585 is classified as a high severity vulnerability due to its potential for reflected Cross-site Scripting (XSS) attacks.
2
How do I fix CVE-2025-53585?
To fix CVE-2025-53585, update NooTheme WeMusic to version 1.9.2 or later.
3
What systems are affected by CVE-2025-53585?
CVE-2025-53585 affects WeMusic versions 1.9.1 and earlier.
4
Can CVE-2025-53585 be exploited remotely?
Yes, CVE-2025-53585 can be exploited remotely through specially crafted input on affected web pages.
5
What types of attacks can CVE-2025-53585 facilitate?
CVE-2025-53585 can facilitate reflected Cross-site Scripting attacks, compromising user data and session security.