This flaw is an improper neutralization of input during web page generation, a CWE‑79 vulnerability that allows attackers to inject malicious script into a page that is reflected back to the user. The impact is that an attacker can execute arbitrary client‑side code in the victim’s browser, potentially leading to session hijacking, credential theft, defacement, or the execution of further malicious payloads. The vulnerability is exploitable without additional privileges and can be triggered solely by a crafted URL or form input.

The affected product is the Tantyyellow WordPress theme by ta2g, versions up to and including 1.0.0.5 are vulnerable. These versions are available as standard theme installations for WordPress sites.

The CVSS v3 score of 7.1 indicates high severity, but the EPSS score of less than 1% suggests a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no known large‑scale exploits at this time. The likely attack vector is a reflected XSS scenario where an attacker provides a malicious URL to a victim; the script is executed in the victim’s browser context. Further exploitation would require the victim to accept and run the injected script.