Unauthenticated XSS in SpaLab Beauty Salon WordPress Theme

Unauthenticated Cross Site Scripting (XSS) in SpaLab | Beauty Salon WordPress Theme <= 6.7 versions.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability represents a critical supply chain risk in the WordPress ecosystem. CVE-2025-69154 is an unauthenticated Cross-Site Scripting (XSS) flaw affecting SpaLab Beauty Salon WordPress Theme versions 6.7 and earlier, allowing attackers to inject malicious scripts without authentication. The CVSS 7.1 rating reflects the high severity—any visitor to an affected site could be compromised. This impacts thousands of small businesses, salons, and service providers relying on this popular WordPress theme, making it an attractive target for attackers seeking to compromise customer data, inject malware, or redirect users to malicious sites.

Casky's 322 mapped skills leverage Claude AI with extended reasoning to detect the attack chains underlying this vulnerability across two critical MITRE ATT&CK tactics: Initial Access (TA0001) and Reconnaissance (TA0043). Practitioners using Casky would identify suspicious patterns including unauthenticated parameter injection attempts, script tag placement in user-controlled inputs, and DOM-based payload delivery mechanisms typical of XSS exploitation. The platform's skill set would flag requests containing encoded or obfuscated JavaScript, event handler attributes, and common XSS vectors (alert boxes, fetch calls, cookie exfiltration) before they execute. Security teams would see detailed findings showing exact injection points, payload variations, and the execution context—enabling rapid patching prioritization and forensic investigation of theme installations still running vulnerable versions 6.7 or below.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2025-69154.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

achieving-cmmc-level-2-compliance

compliance governance · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2025-69154

Casky has 322 skills that investigate the attack patterns behind CVE-2025-69154. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn