The vulnerability resides in the "Invico - WordPress Consulting Business Theme" where input is not properly neutralized when generating page output. An attacker can inject malicious JavaScript that the victim’s browser will execute when viewing a page, enabling session hijacking, defacement, or other client‑side attacks. This flaw is a classic input validation weakness documented as CWE‑79.

The flaw affects all installations of Invico version 1.9 or earlier. Any WordPress site that has this theme active is potentially vulnerable; the specific version range is limited to the releases labeled 1.9 and earlier.

The CVSS score of 7.1 indicates a high severity risk, while the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation. The likely attack vector is through crafted URLs or input fields that return the attacker’s payload in the page’s HTML, targeting users who load the affected page. Exploitation requires user interaction (e.g., clicking a link) but technical barriers are low, and the flaw can be abused by adversaries with social engineering techniques.