This CVE describes an improper neutralization of input during web page generation that allows an attacker to inject malicious scripts via the WordPress Gravel theme. The vulnerability is a reflected XSS flaw, which means a crafted URL can cause arbitrary script execution in the victim’s browser when a user views the page. An attacker could steal session cookies, perform account takeover, inject unwanted content, or redirect users to phishing sites. The impact is confined to the browser of anyone who accesses the malformed URL, but because the URL can be shared publicly, the attack surface is broad.

The vulnerability affects the WordPress Gravel theme distributed by the vendor noonnoo, specifically all releases up to version 1.6 inclusive. Any WordPress site that has installed this theme is potentially vulnerable.

With a CVSS score of 7.1 the flaw is considered high risk. The EPSS score of less than 1% indicates a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, relying on a crafted HTTP request that causes the theme to echo unsanitized input back to the browser. No authentication or local privileges are required, so any web visitor can trigger the issue.