The Power Mag theme contains a DOM‑based Cross‑Site Scripting flaw that permits an attacker to inject malicious script into the page. This improper neutralization of user input can lead to client‑side compromise, such as cookie theft, session hijacking, or the execution of arbitrary code in the victim’s browser. The vulnerability resides in the theme’s rendering functions and can be triggered via web requests that influence content generation.

The affected software is the Codetrendy Power Mag WordPress theme, versions up through 1.1.5. All releases from the initial version up to and including 1.1.5 are impacted.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to involve user‑controlled input in the web interface that leads to DOM manipulation; thus an attacker with access to a web page can potentially deliver crafted content.