CVE-2025-67922 ThemeGoods CVE debrief

Who should care

Defenders responsible for WordPress installations using the Grand Restaurant theme, particularly those with user-generated content or public-facing sites, should assess exposure and prioritize updates.

Why it matters

CVE-2025-67922 is a Cross-site Scripting (XSS) vulnerability in the Grand Restaurant theme for WordPress. Defenders should care because it allows for Reflected XSS attacks, potentially impacting WordPress installations using this theme. The vulnerability has a CVSS score of 7.1 and affects versions from n/a through 7.0.8. Updating to version 7.0.9 or later is recommended.

• Potential for Reflected XSS attacks
• Exposure of WordPress installations using the Grand Restaurant theme
• Need for updates to version 7.0.9 or later
• Monitoring and review of user input required

Technical summary

The Grand Restaurant theme for WordPress is vulnerable to Cross-site Scripting (XSS) attacks, specifically Reflected XSS, in versions from n/a through 7.0.8. The vulnerability has a CVSS score of 7.1. Updating to version 7.0.9 or later is recommended to mitigate this vulnerability. The vulnerability allows for Reflected XSS attacks, potentially impacting WordPress installations using this theme. Defenders should prioritize updating to version 7.0.9 or later to mitigate this vulnerability.

Defensive priority

Defenders should prioritize updating to version 7.0.9 or later to mitigate this vulnerability.

Recommended defensive actions

• Update to version 7.0.9 or later
• Review and monitor user input for potential XSS attacks
• Implement additional security measures to prevent Reflected XSS

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.1 and affected versions from n/a through 7.0.8. The vulnerability allows for Reflected XSS attacks. Defenders should verify the vulnerability details and assess exposure. The CVE Program record and NVD detail page provide source-provided CVE metadata and vulnerability assessment. The official advisory or CVE record should be reviewed to validate affected scope, severity, and vendor guidance

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.