The Simplish WordPress theme lacks proper input neutralisation when rendering pages, allowing an attacker to store malicious JavaScript that will run in every visitor’s browser. This stored cross‑site scripting flaw permits injection of arbitrary scripts, which can lead to data theft, session hijacking, or site defacement. The weakness corresponds to CWE‑79.

All installations of the Simplish theme from its initial release through version 2.6.4 are affected. The theme is maintained by the vendor joshix and is distributed as a WordPress plugin. Sites that have not yet upgraded beyond 2.6.4 remain vulnerable.

The CVSS base score for this flaw is 6.5, indicating a moderate risk level. The EPSS score is below 1 %, suggesting that exploitation is currently considered unlikely, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is stored XSS via theme configuration or user‑provided content that is rendered without escaping; once injected, the malicious code executes in the browsers of all site visitors. Exploitation would typically require administrative access to modify or add content, but the low public exploitation probability does not negate the potentially serious impact on users.