The Build theme for WordPress contains an improper neutralization of input during web page generation that enables a stored cross‑site scripting (XSS) flaw. The vulnerability allows an attacker to insert malicious JavaScript that will be executed in the browsers of site visitors when the affected page is rendered. The impact is cross‑domain script execution, potentially leading to session compromise, data theft, or defacement of the site.

WordPress sites using the Build theme version 1.0.3 or earlier are affected. Versions prior to 1.0.3 are also vulnerable as the issue is present from the first release up to 1.0.3.

The CVSS base score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild. The flaw is not listed in CISA's KEV catalog. Based on the nature of a stored XSS, the likely attack vector is remote, through an authenticated or unauthenticated user entry point that accepts text input and stores it until rendering. Exploitation requires the attacker to create or modify content that includes malicious script, which then runs for any visitor to the affected page.