The Tiger theme for WordPress contains an improper neutralization of user input during page rendering, leading to a reflected XSS vulnerability. When a malicious payload is included in a request, it is reflected back into the response without proper escaping, allowing an attacker to execute arbitrary JavaScript in the victim’s browser. This flaw directly compromises the integrity of the site for visitors.

The WordPress Tiger theme, versions up to and including 2.0, is vulnerable.

The CVSS score of 7.1 marks this flaw as high severity, and the very low EPSS (<1%) indicates that exploit attempts are currently rare, though the condition for exploitation is simple: an attacker only needs to craft a URL or input that is reflected. Because the vulnerability is not listed in the CISA KEV catalog, there is no known active exploitation campaign, but the potential for an attacker to execute malicious code is clear if a user visits a malicious link or submits crafted data.