The Restaurant theme by ayecode contains an input neutralization flaw that allows reflected XSS. Attackers can supply malicious payloads that are echoed back into the page without proper escaping, enabling clients to execute arbitrary JavaScript in the victim’s browser. This flaw lies in the content generation path and can lead to credential theft, session hijacking, or defacement of the site. The weakness is classed as CWE‑79.

Web sites that use the ayecode Restaurante theme version 3.0.7 or earlier are vulnerable. The issues affect all releases from the first release (n/a) up through 3.0.7, inclusive. No other versions are listed as affected.

The vulnerability has a CVSS score of 7.1, classifying it as high severity. The current EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting limited current exploitation pressure. The attack vector is likely a reflected XSS attack, where a malicious link or form parameter delivers a payload that is echoed back to the user's browser. The exploit requires only that a user visit a crafted URL or submit a crafted form; no authentication is required. Given the high impact and the fact that it can be triggered from an external source, the risk remains significant for exposed sites running vulnerable theme versions.