Improper neutralization of input during web page generation in the Takimi Themes CarZine WordPress theme leads to a reflected XSS vulnerability. An attacker can inject malicious scripts into page responses that the victim's browser will execute, potentially enabling session hijacking, defacement, or other client‑side attacks.

WordPress installations that use the Takimi Themes CarZine theme with a version number up to and including 1.4.6 are affected. Any site that has not yet upgraded beyond 1.4.6 may be vulnerable if the theme’s input handling remains unchanged.

The CVSS score of 7.1 indicates a moderate‑to‑high severity. The EPSS score of less than 1 % suggests the likelihood of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. The reflected nature of the flaw allows a remote attacker to craft a URL or form submission that, when visited by a victim user, causes the browser to execute attacker‑supplied scripts. Successful exploitation requires the target site to be publicly accessible and the victim to be tricked into visiting the maliciously crafted link or data‑filled form.