Improper neutralization of input during page generation allows attackers to inject malicious scripts that are reflected back to the user, enabling theft of sensitive data or session hijacking. This reflected XSS flaw is based on CWE‑79 and can be triggered by manipulating input parameters that are not sanitized before rendering.

WordPress theme UltraLight (rarathemes) is affected for all versions up to and including 1.2. No earlier versions are listed, and the issue has not been fixed in the current release line. Administrators should verify whether the installed version falls within the vulnerable range.

The CVSS score of 7.1 indicates high potential impact. The EPSS score of less than 1% suggests that automated exploitation is currently unlikely, and the vulnerability is not listed in CISA's KEV catalog. The likely attack path relies on a crafted URL or form input that the theme reflects back to the visitor's browser.