The Drift WordPress theme allows speakers with Contributor permissions or higher to store arbitrary JavaScript inside blog post titles. Because titles are output without proper escaping, the injected script runs in the browsers of any user who views the affected post, giving attackers a persistent cross‑site scripting vector that can compromise confidentiality, integrity, or availability of user sessions.

WordPress installations that are using the Drift theme version 1.5.0 or earlier. Any site running the theme with a Contributor or higher role is vulnerable. The issue affects all WordPress sites that have not upgraded beyond v1.5.0.

The CVSS score of 6.4 indicates a moderate severity vulnerability, while the EPSS score of less than 1% shows a very low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Attackers need to be logged in with a Contributor account or higher, so the attack vector is authenticated. Once authenticated, an attacker can inject scripts that execute on every page load containing a malicious post title, potentially leading to credential theft or defacement.