Technical impact
The vulnerability is a Cross‑Site Request Forgery flaw in Themefy's Bloggie WordPress theme that permits an attacker to inject malicious JavaScript into a reflected parameter. An attacker can craft a URL that, when visited by an authenticated user, will execute script in their browser, allowing session hijacking, cookie theft, defacement, or the execution of arbitrary actions on behalf of that user. This issue combines CSRF (CWE‑352) with reflected XSS, exposing a typical web‑application weak point.
Affected Systems
Affects the Bloggie theme for WordPress distributed by Themefy, all releases up to and including 2.0.8. Sites that still use any 2.0.8 or older version of the theme are vulnerable. The advisory does not list later fix releases, but upgrading to any 2.0.9 or newer version should mitigate the problem.
Risk and Exploitability
The CVSS score of 7.1 classifies the problem as high severity, yet the EPSS score is below 1%, indicating a low current exploitation probability. The vulnerability is not part of the CISA known exploited catalog. Attackers can exploit it remotely via a web browser by delivering a crafted link or form that submits a forged request to the site. No authentication is required for the forged request to trigger the reflected XSS.
