The Tiger theme contains an improper neutralization of input that allows stored cross‑site scripting, aligning with CWE‑79. Malicious scripts injected into content will execute whenever a victim loads a page rendered by the theme, potentially enabling defacement, theft of session identifiers, or other client‑side attacks. This weakness does not grant direct server‑side privileges but can undermine user trust and content integrity.

WordPress sites that use the Tiger theme developed by hutsixdigital through version 2.0 are affected. All releases in that range are vulnerable; no other WordPress themes or plugins are impacted.

The CVSS score of 6.5 indicates medium severity, and the EPSS score of <1% suggests that exploitation is historically rare, with the vulnerability not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through the theme’s administrative or content‑creation interfaces where user input is stored without proper escaping; once stored, the code executes in any browser rendering the affected page. The exploit requires the ability to add or edit content, meaning that if an attacker can compromise an account with such permissions, they can trigger the stored XSS.