The vulnerability arises from improper neutralization of input during web page generation in the xSmart theme. A malicious user can supply crafted query parameters or form data that is not properly sanitized and is echoed back into the browser, leading to a reflected XSS. An attacker who succeeds can execute arbitrary JavaScript in the context of the victim's browser, allowing session hijacking, phishing, or defacement. The weakness is a classic input validation flaw identified as CWE‑79. The impact is limited to the context of the web page rendered by the affected theme and can compromise confidentiality, integrity, and availability of the affected site if the user interacts with the crafted content.

The xSmart WordPress theme version 1.2.9.4 and all earlier releases published by Jthemes are vulnerable. Any WordPress installation that includes these theme files is at risk.

The CVSS base score of 7.1 indicates a high severity. The EPSS score is less than 1 %, suggesting that, while the vulnerability exists, the projected exploitation probability is low. The vulnerability is not listed in the CISA KEV catalog. Exploits require an attacker to convince a victim to visit a crafted URL or submit a malicious form to a site running the affected theme. No authentication is needed, and the exploitation can be performed over the public internet. Due to the reflected nature, the attack surface is relatively large but may be mitigated by user behaviour and browser security controls.