The vulnerability is an improper neutralization of input during web page generation (Cross‑Site Scripting). An attacker can inject malicious script into a URL or form that, when processed by the offset‑writing theme, is reflected back to the victim’s browser. The impact is the ability to execute arbitrary code in the context of the victim’s session, potentially leading to data theft, session hijacking, or defacement. The weakness is consistent with CWE‑79.

The offset‑writing theme for WordPress, developed by twh, is affected. Any installation of the theme dated from the initial release through version 1.2 is vulnerable. Versions beyond 1.2 are not listed as affected.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires an attacker to craft a malicious URL or input that is accepted by the theme’s rendering logic; the victim must then visit the reflected page. Because the attack vector is presented via a reflected input it is likely to be executed through phishing or compromise of a link.