The Spare WordPress theme contains an improper neutralization of user input during web page rendering, allowing attackers to inject arbitrary JavaScript that is reflected back to victims. This reflected XSS flaw can be used to hijack sessions, steal credentials, deface content, or redirect users to malicious sites, thereby compromising confidentiality, integrity, and potentially availability of the site’s users.

WordPress users running themeton’s Spare theme versions up to and including 1.7 are affected. All releases prior to 1.8 contain the unsafe input handling that leads to reflected XSS.

The flaw carries a CVSS score of 7.1, an EPSS score of less than 1%, and is not listed in the CISA KEV catalog. Attackers can exploit the vulnerability simply by delivering a crafted link or form to a victim; no authentication or privilege escalation is required. The low EPSS suggests opportunistic exploitation, but the high impact of reflected XSS still warrants immediate attention.