The Neom Blog theme distributes code that does not properly neutralize user supplied input when generating web pages, allowing attackers to inject malicious scripts that execute in victims’ browsers. This reflected XSS flaw enables an attacker to insert arbitrary JavaScript into the HTML sent to a victim, potentially stealing credentials, hijacking sessions, or delivering further malware. The weakness is a classic input handling error classified as CWE‑79.

The vulnerability exists in awordpresslife Neom Blog theme versions from the earliest release through version 0.0.9. Users running any of those releases on a WordPress site are susceptible; any site that has not updated beyond 0.0.9 is at risk.

The CVSS score of 7.1 indicates a high severity that can impact confidentiality and integrity, yet the EPSS score of less than 1% suggests very low exploitation probability at present. The issue is not catalogued in the CISA KEV list, so no known widespread exploitation has been reported. Attackers would need to entice a user to visit a crafted URL containing the malicious payload, making the vulnerability largely user‑dependent. Because the flaw is reflected, exploitation does not require privileged access or server compromise, increasing its attractiveness to threat actors capable of phishing or social engineering.