The vulnerability arises from the Killer Theme Options plugin’s failure to neutralize user‑supplied input before rendering it, resulting in a reflected XSS flaw. This flaw allows an attacker to embed malicious script into the output that is shown to users who view the affected page, potentially executing arbitrary JavaScript in the victim’s browser. It is classified as CWE‑79.

All WordPress sites running Punit Bhalodiya's Killer Theme Options plugin version 2.0 or earlier are vulnerable. The issue covers releases from the earliest available version through to version 2.0, so any installation that has not upgraded beyond this point remains at risk.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the nature of reflected XSS, an attacker can exploit the flaw by crafting a URL or form that contains malicious payloads; when a victim follows the link or submits the form, the payload is reflected back into the page and executed in the victim’s browser. The attack can be performed through the public interface of the plugin.