CVE-2025-47916

Public exploit available. Not confirmed exploited in the wild yet. Fixed in 5.0.7.

CVSS 3.110.0Critical EPSS percentile99th84% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source Fix5.0.7Upgrade to this build

Published 2025-05-16Updated 2025-06-20Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

invisioncommunity Invision Power BoardAffected: ≥ 5.0.0, < 5.0.7Upgrade to: 5.0.7Stated by: CVE record
InvisioncommunityAffected: ≥ 5.0.0, < 5.0.7Upgrade to: 5.0.7Stated by: NVD
Invision Community IPS Community SuiteAffected: от 5.0.0 до 5.0.6 включительноUpgrade to: not statedStated by: BDU

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check your Invision Community version number in the admin control panel.
If it is 5.0.0 through 5.0.6, treat this as urgent.
Upgrade to version 5.0.7 or later immediately.
After upgrading, check server and site logs for any unusual activity around the themeeditor page from before the update.
If you cannot upgrade right away, ask your host or developer to block public access to themeeditor.php until you can.

Usually a quick update

Check it yourselfA free Nuclei check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method; hence it is evaluated by the template engine. Accordingly, this can be exploited by unauthenticated attackers to inject and execute arbitrary PHP code by providing crafted template strings.

In plain language

Written by AI from the record

If you run a community forum on Invision Community before version 5.0.7, an attacker can take over your server without even logging in — this needs to be fixed now.

Unauthenticated remote code execution in Invision Community 5.0.0–5.0.6 via the themeeditor.php customCss method, which passes attacker-controlled template content into the theme engine's process function, allowing arbitrary PHP injection without login.

If you're affected

Full server takeover
Customer/member data exposure
Website defacement
Ransomware risk
Forum downtime

What is it

Think of your forum software like a storefront with a back office that's supposed to be locked. This flaw means anyone walking by can slip a note under the back-office door that the staff automatically reads and acts on — except the 'note' is actually a command that lets them run the business themselves. No key or password needed.

Who is affected

This matters to you if you run Invision Community (also sold as IPS Community Suite or Invision Power Board) version 5.0.0 up to 5.0.6 for your forum, support site, or online community. It affects the software out of the box, with no special settings required, and no attacker login or user interaction needed — if your site is reachable on the internet, it is exposed.

How urgent is it

This is a critical, actively weaponized flaw: a working public exploit already exists, meaning attackers don't need deep skill to use it. Press coverage has been sustained, drawing attention from opportunistic attackers scanning the internet for vulnerable sites. Treat this as an emergency — patch before doing anything else with this site.

What to do — in detail

Identify all Invision Community / IPS Community Suite instances and confirm exact version via the admin control panel or by checking applications/core/data/metadata.json.
Any instance on 5.0.0–5.0.6 is vulnerable; upgrade to 5.0.7 (see vendor release notes: https://invisioncommunity.com/release-notes-v5/507-r41/).
Apply the upgrade via the standard IPS upgrader; no known breaking changes are flagged for this specific security point release, but review release notes for any accompanying schema/plugin compatibility notes.
If immediate patching isn't possible, restrict or block public access to /applications/core/modules/front/system/themeeditor.php at the web server/WAF layer as a temporary mitigation, and consider taking the site offline until patched given active exploitation.
After patching, audit web server access logs for requests to themeeditor.php with unusual 'content' parameters prior to the patch date, and review server file integrity/webshells as indicators of prior compromise.
Not in CISA KEV at this time, so no federal remediation deadline applies, but a public exploit (CWE-94 / CWE-1336 template injection leading to RCE) means risk is equivalent to KEV-listed urgency; prioritize accordingly.
Monitor vendor advisories for any follow-up hotfixes and subscribe to Invision security bulletins.

Technical context

CVSS 3.1 base score 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) — network-exploitable, no privileges or user interaction, full confidentiality/integrity/availability impact with scope change. Root cause: CWE-94 (code injection) via CWE-1336 (improper neutralization of special elements in a template engine) — the themeeditor controller's customCss method passes unsanitized 'content' parameter into Theme::makeProcessFunction(), which the template engine evaluates as executable PHP. A public exploit (1 known) exists, and EPSS places likelihood of exploitation in the attack's favor near the top percentile, though the trend is currently falling. Not currently listed in CISA KEV, but sustained press attention and exploit availability indicate high real-world risk independent of KEV status. Fixed in version 5.0.7.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

84% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 259 days before any public exploit.

2026-06-22EPSS band changecritical → high
2026-03-23EPSS band changehigh → critical
2026-03-07Public exploit / PoCsource: other
2026-03-06Nuclei check added
2025-06-20Patch availablerecord updated
2025-05-16Publishedweakness classified, att&ck mapped

Affected products

invisioncommunitycommercialaka invision power board, ips community suite
- Invision Power BoardSaaSWeb & CMS Plugins / forum-wiki
- invisioncommunitySaaSWeb & CMS Plugins / forum-wiki
Invision Communitycommercialaka ips community suite, invision community suite
- IPS Community SuiteOn-premWeb & CMS Plugins / forum-wiki

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable