CVE-2025-68524PATCHED

themegoods · avante

WordPress Avante theme < 3.0.5 - Reflected Cross Site Scripting (XSS) vulnerability

Description

Unauthenticated Cross Site Scripting (XSS) in Avante < 3.0.5 versions.

Affected Products

Vendor	Product	Versions
themegoods	avante	n/a, 3.0.4

References

https://patchstack.com/database/wordpress/theme/avante/vulnerability/wordpress-avante-theme-3-0-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve(vdb-entry)

Related News (1 articles)

Tier C

VulDB26d ago

CVE-2025-68524 | meGoods Avante Plugin up to 3.0.4 on WordPress cross site scripting

→ No new info (linked only)

CVSS 3.17.1 MEDIUM

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CISA KEV❌ No

Actively exploited❌ No

Patch available

3.0.5

CWECWE-79

PublishedJun 17, 2026

Last enriched26d agov2

Trending Score1

Source articles1

Independent1

Info Completeness9/14

Missing: epss, kev, exploit, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (3)

CRITICALCVE-2026-57770EXP

WordPress Grand Photography theme <= 5.7.8 - PHP Object Injection vulnerability

Trending: 57

HIGHCVE-2025-69152

WordPress Artale | Wedding Photography WordPress theme <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

Trending: 6

HIGHCVE-2025-69151

WordPress Grand Car Rental theme <= 3.7 - Cross Site Scripting (XSS) vulnerability

Trending: 1

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Jun 17, 2026

Discovered by ZDM

Jun 17, 2026

Patch Available

Jun 17, 2026

Updated: affectedVersions, severity

Jun 17, 2026

Version History

Last enriched 26d ago

v2Tier C26d ago

Updated vendor to meGoods, product to Avante Plugin, affected versions to 3.0.4, severity to MEDIUM, and noted no available exploit.

affectedVersionsseverity

via VulDB

v126d ago

Initial creation