Improper neutralization of input during web page generation in the Jthemes Themebox – Digital Products Ecommerce theme allows reflected XSS. An attacker can send a crafted URL or payload that the theme will echo back to the victim’s browser without proper escaping, enabling the execution of arbitrary JavaScript in the user’s session. This can lead to cookie theft, session hijacking, content injection, or defacement of the site, depending on the privileges of the user who opens the link.

The vulnerability affects the WordPress Themebox – Digital Products Ecommerce theme, versions from the earliest release through 1.4.2. Users of this theme on any WordPress installation are potentially impacted unless the theme has been updated to a later, non‑vulnerable release.

The CVSS score of 7.1 indicates a high severity level, but no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is reflected, exploitation requires victim interaction with a crafted URL or input, however the broad use of WordPress themes and the ease of creating such payloads make the risk significant for sites that rely on this theme and expose potentially untrusted data on their front‑end. Attackers could leverage the XSS flaw to compromise user sessions, deface pages, or deliver further exploits in the victim’s browser.