The vulnerability originates from improper neutralization of user‑supplied input during page rendering in the Theme Demo Bar plugin. Unsanitized parameters are echoed back to the browser, allowing an attacker to inject and execute arbitrary JavaScript. This classic reflected XSS can lead to data theft, session hijacking, or drive‑by compromises by exploiting the victim’s authenticated session context.

WordPress sites running the Theme Demo Bar plugin from zenverse that are on version 1.6.3 or earlier are affected. Any installation that has not been updated to a newer release is susceptible to exploitation.

The CVSS score of 7.1 signals a high‑impact, remote attack scenario, while the EPSS score of less than 1% indicates low current exploit activity. The flaw is not listed in CISA’s KEV catalog, suggesting no large‑scale exploitation has been observed. An attacker can craft a malicious URL containing unsanitized parameters and, without authentication, trick a user into visiting the link to trigger script execution in the user’s browser.