The vulnerability is an improper neutralization of input during web page generation that allows an attacker to inject malicious scripts into the browser context. Because the flaw is DOM‑based, an attacker can potentially execute code in the victim’s browser, steal session cookies, redirect users, or deface pages. The weakness is classified as CWE-79.

The flaw affects the WordPress Digi Store theme by Code Themes, all versions up to and including 1.1.4. No later versions have been verified to contain the fix, so any site that still runs 1.1.4 or earlier is susceptible.

Based on the description, the likely attack vector is a web‑based route that injects script payloads into the theme’s pages, typically via user‑supplied input reflected in the DOM without proper encoding. The CVSS score of 6.5 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of public exploitation at this time. The issue is not listed in the CISA KEV catalog.