The vulnerability is an improper neutralization of user input that allows reflected XSS within the WordPress Tijaji theme. The flaw means that an attacker can embed malicious script code in a request that is reflected back in the page without proper escaping, potentially leading to defacement, credential theft, or session hijacking. The weakness is the classic input validation/flawed sanitization error identified as CWE‑79.

WordPress sites using the Tijaji theme version 1.43 or earlier are impacted. The vulnerability exists from the earliest available version (“n/a”) up to and including 1.43. Any site that has installed this theme version should be considered affected.

The CVSS score of 7.1 reflects a high‑severity risk. The EPSS score of less than 1% indicates that, at the time of this assessment, exploitation probability is very low, and the vulnerability is not listed in the CISA KEV catalog. The flaw is exploitable via reflected requests – an attacker must craft a URL or form that passes malicious data to a vulnerable endpoint. From the data provided, it is inferred that the attack vector is from the web browser, using the theme’s output rendering process.