Improper neutralization of user input during web page generation in the GT3themes ListingEasy theme enables an attacker to inject malicious scripts through reflected XSS. By sending a crafted request that includes malicious code, an attacker can cause the script to execute in the browser of any user who views the affected page, leading to session hijacking, defacement, or execution of further payloads within the compromised web application. The weakness is identified as CWE‑79 and can compromise confidentiality, integrity, and availability of site data if exploited.

WordPress sites that use the GT3themes ListingEasy theme version 1.9.2 or earlier and have not yet applied the vendor patch.

The CVSS score of 7.1 indicates high severity. The EPSS score of less than 1% suggests exploitation is relatively unlikely in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely a reflected request—either a URL parameter or form input—that the theme fails to sanitize before echoing. An attacker must entice a user to visit the crafted URL; once visited, the malicious script runs with the privileges of that user.