The WeMusic theme contains an improper neutralization of input during web page generation that allows attackers to inject malicious JavaScript through user‑supplied data, leading to a reflected cross‑site scripting (XSS) vulnerability (CWE‑79). This flaw enables attackers to execute arbitrary scripts in the context of a victim’s browser, which can be used for phishing, cookie theft, or defacement. The vulnerability is triggered by referrable user data and results in a loss of confidentiality and integrity for any authenticated or unauthenticated user who views the affected page.

The critical component is the NooTheme WeMusic WordPress theme. All releases through version 1.9.1 are affected. Users running these versions should review their WordPress installations for the presence of the WeMusic theme.

The CVSS score of 7.1 classifies this issue as high severity, and the EPSS score of less than 1% indicates a low probability of active exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploit requires a web request containing the malicious payload – typically an attacker can craft a link and trick a victim into visiting it, which triggers execution of the injected script.