Improper Neutralization of Input During Web Page Generation leads to a reflected XSS flaw that allows an attacker to inject arbitrary scripts into pages served by the Nuss theme. When a victim clicks a crafted link, the malicious script runs in their browser, potentially enabling session hijacking, data theft, or site defacement. The vulnerability is a classic input validation weakness (CWE‑79) and does not grant arbitrary code execution on the server side.

The affected product is the WordPress theme Nuss from vendor uxper. All theme releases up to and including version 1.3.3 are vulnerable. No other versions are listed as impacted.

The CVSS score is 7.1, indicating a medium‑high severity risk. EPSS indicates an exploitation probability of less than 1 %, so active exploitation is currently unlikely. The vulnerability is not in CISA’s KEV catalog, and no public exploits have been reported. The likely attack vector is the web, requiring the attacker to entice a user to visit a maliciously crafted URL or page. Administrators should treat this as a moderate‑to‑high risk that warrants immediate mitigation.