An attacker can inject malicious JavaScript into a page via user-supplied input that is not properly encoded: the vulnerability allows the execution of arbitrary code in the context of the victim's browser session. This can lead to session hijacking, defacement, or phishing attacks. The weakness follows the classic XSS pattern and is identified as CWE‑79, highlighting improper neutralization of input during page generation.

WordPress sites that use the My White theme in versions up to and including 2.0.8 are affected. The theme, developed by mythemes, is deployed in various WordPress installations, and any user capable of loading a crafted URL or form with malicious payload can trigger the flaw.

The CVSS v3 score of 7.1 indicates a high severity for a reflected XSS flaw. Although the EPSS suggests a low probability of exploitation (<1%), the attack is straightforward to execute with a crafted link, implying that users who are exposed to untrusted input from unknown sources are at risk. The vulnerability is not listed in the CISA KEV catalog, but its prevalence in a popular theme increases the overall risk. No authentication is required beyond a legitimate visitor session, making the issue easily exploitable in shared or public sites.