The Homey theme for WordPress contains an improper neutralization of user input that results in reflected cross‑site scripting. When a maliciously crafted request is processed by the theme, the victim’s browser receives and executes arbitrary JavaScript inserted by an attacker. This can lead to cookie theft, session hijacking, or site defacement. The flaw is a classic input‑validation weakness (CWE‑79).

Any WordPress site that has installed favethemes Homey version 2.4.5 or earlier is affected. The vulnerability exists in all releases from the first version through 2.4.5, which is the current production‑stable release before the last update.

The CVSS base score of 7.1 indicates a high‑moderate severity. The EPSS score of less than 1% suggests that exploitation attempts are unlikely to be widespread at this time, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector requires an attacker to send a crafted URL or form input that the theme reflects unescaped in the generated page, which a victim then opens. While the immediate impact is confined to the web pages rendered by the theme, a successful exploit can compromise the victim’s session and enable further attacks from that user’s perspective.