The vulnerability exists in the Renden WordPress theme up to version 1.8.1. Insufficient sanitization of the post title field allows an authenticated user with Contributor or higher access to embed arbitrary JavaScript. When a victim views the affected post, the injected script runs in the victim’s browser, enabling phishing, cookie theft, or other client‑side attacks. The weakness is an injection flaw (CWE‑79).

WordPress installations using the Renden theme, any version up to and including 1.8.1. The product is identified by the CNA as thinkupthemes:Renden; affected users are those who have adopted this theme during that period.

The CVSS score of 6.4 reflects moderate severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Attackers must be authenticated with at least Contributor privileges to inject the title. Post‑editor input is not sanitized and output is not escaped, providing a straightforward exploitation path once credentials are obtained.