Executive brief
The Fitness Zone WordPress theme, used for gym and health club websites, contains a security flaw that allows attackers to inject malicious scripts into the site. If a site administrator or visitor clicks a specially crafted link, the attacker could potentially hijack their session, redirect users to malicious websites, or deface the site. As of the latest report, no official patch has been released by the developer.
Technical details
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Fitness Zone WordPress theme through version 5.7 due to improper neutralization of user-supplied input during web page generation (CWE-79). The vulnerability is unauthenticated, meaning an attacker does not need an account on the target site, though it requires user interaction (such as a victim clicking a malicious link). Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, which can lead to session hijacking or unauthorized actions. No official patch is currently available; users are advised to use web application firewalls or mitigation rules to block suspicious requests.
Affected products
- Designthemes Fitness Zone WordPress Theme <= 5.7
Timeline
- 2025-11-07: disclosed: Vulnerability reported by researcher João Pedro S Alcântara
- 2026-06-30: advisory: Initial advisory published by Patchstack
- 2026-07-02: advisory: CVE published to the NVD dataset