The Whitish Lite theme contains a stored cross‑site scripting flaw that allows attackers to inject malicious JavaScript into the site’s output. An attacker who can create or modify content can embed code that will be served to every visitor, enabling session hijacking, cookie theft, or phishing attacks. The flaw maps to CWE‑79.

The vulnerability impacts yudleethemes Whitish Lite versions through 2.1.13, including all earlier releases. It is present in every installation that uses this theme and has not been fixed until a newer release is available.

The CVSS base score of 6.5 categorizes the issue as medium severity. The EPSS value of less than 1 % suggests that exploitation attempts are currently rare, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack path requires a user with content‑creation privileges or administrative access to the theme; an attacker could submit malicious payloads that are then stored and later served to visitors.