This vulnerability is caused by improper neutralization of user input during web page generation, resulting in a DOM‑based cross‑site scripting flaw. An attacker can inject malicious scripts into the theme’s front‑end pages, which are then executed in the browsers of unsuspecting visitors. The attack could allow defacement, credential theft, or delivery of further malware by hijacking user sessions.

The flaw is present in the WordPress theme Spark Multipurpose, version 1.0.7 and older, developed by sparklewpthemes. All installations of the theme at or below 1.0.7 are affected; newer releases are not mentioned as vulnerable.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of <1% suggests a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to view a web page that includes the vulnerable output, so the attack surface is limited to the theme's front‑end. Immediate patching is the most effective mitigation.