Improper neutralization of user input in the ApusTheme Drone WordPress theme enables a reflected cross‑site scripting (XSS) flaw. An attacker can inject malicious JavaScript that is echoed back by the site, potentially allowing theft of cookies, login tokens, or sensitive information from victim browsers.

All installations of the ApusTheme Drone theme version 1.40 and earlier are vulnerable. This includes any WordPress site that has not upgraded past the 1.40 release.

The CVSS score of 7.1 indicates a medium to high severity and a possible impact on confidentiality, integrity, and availability of user data. The EPSS score of <1% suggests that exploitation, if it occurs, is unlikely but still feasible. The vulnerability is not listed in CISA’s KEV catalog, underscoring its relatively low exploitation probability under current threat conditions. The likely attack vector is that an attacker can craft a malicious URL or link containing harmful query parameters; a victim who visits the link will trigger the reflected XSS. Based on the description, it is inferred that the vulnerability is exploitable via the web interface alone, without additional access.