Improper neutralization of input during web page generation allows reflected XSS in the Jobmonster theme. An attacker can embed malicious JavaScript that runs in the context of a victim’s browser, enabling session hijacking, credential theft, or defacement of the site. The vulnerability does not provide direct remote code execution on the server, but the impact is significant for end users whose browsers execute the injected script.

WordPress sites using the NooTheme Jobmonster theme version 4.7.8 or earlier are affected. The issue is not limited to any specific plugin or additional components beyond the theme itself.

The CVSS score of 7.1 indicates a high severity for this reflected XSS flaw, though the EPSS score of less than 1% suggests a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, which indicates it has not yet been widely abused. Likely exploitation would involve a user clicking on a crafted link or submitting a form that triggers the XSS, making the attack vector primarily user‑initiated. While the impact on confidentiality, integrity, and availability is limited to the user’s browser session, the risk remains high for sites that expose sensitive data in the front‑end.