The vulnerability is an improper neutralization of input during web page generation, allowing reflected XSS. A malicious actor can inject crafted JavaScript that is executed in the victim’s browser when the page is loaded, potentially stealing session cookies, forging requests, or redirecting users to phishing sites. The impact includes loss of confidentiality and integrity for affected users and can be used for credential theft or malicious content injection.

WordPress sites that use the Ghostwriter theme from the earliest releases through version 1.4, developed by Bruno Cavalcante. Any installation of Ghostwriter 1.4 or earlier is vulnerable.

The CVSS score of 7.1 indicates a high severity. The EPSS score of less than 1% suggests a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only a crafted URL to be visited by a user; no authentication or privilege escalation is needed. Attackers can launch the XSS attack remotely by embedding the malicious payload in a link or form that a victim clicks on.