The Puzzles WordPress theme contains a stored cross‑site scripting flaw that can be triggered via shortcodes in content written by users with contributor or higher permissions. The vulnerability stems from inadequate sanitization of user‑supplied shortcode attributes and the failure to escape output before rendering it in pages. An attacker who can create or edit content can embed malicious JavaScript, which will run in the browsers of anyone who visits the affected page. The description explicitly states that the flaw is exploitable by authenticated users, implying that the attack vector requires login and sufficient role privileges, but the exact method of injection is not detailed in the advisory.

WordPress installations that use the ThemeREX Puzzles theme (WP Magazine / Review with Store) with a version of 4.2.6 or earlier are affected. No additional product or version details are provided beyond the theme name and the upper bound version.

The CVSS score of 6.4 indicates a medium severity impact, while the EPSS score of less than 1% suggests the likelihood of exploitation is currently very low. The vulnerability is not listed in CISA’s KEV catalog. Because only authenticated users with contributor-level or higher access can inject scripts, the risk is confined to sites where such roles exist and are granted the ability to edit or publish posts. If an attacker gains this level of access, they can compromise the integrity and confidentiality of any visitor’s browser session, potentially leading to credential theft or session hijacking.