CVE-2025-12117 is a stored cross-site scripting vulnerability in the Renden WordPress theme caused by insufficient input sanitization and output escaping of the post title. Authenticated attackers with Contributor-level privileges or higher can inject arbitrary web scripts into posts, which execute in the context of users viewing those posts. This vulnerability affects all versions up to and including 1.8.1. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity with no availability impact.

Exploitation allows authenticated users with Contributor-level access or higher to inject persistent malicious scripts into post titles. These scripts execute in the browsers of users who view the compromised posts, potentially leading to unauthorized actions or data disclosure within the context of the affected WordPress site. The impact is limited to confidentiality and integrity with no availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or limiting the use of the Renden theme. Monitor official thinkupthemes communications for updates regarding patches or mitigations.