The vulnerability is a Reflected Cross‑Site Scripting flaw in the ThimPress Resca theme caused by improper neutralization of user input. An attacker who can control or inject content into a specially crafted URL or form field can cause victim browsers to execute arbitrary JavaScript. This can lead to credential theft, session hijacking, defacement or the distribution of malicious payloads, impacting the confidentiality, integrity and availability of the affected WordPress site.

Both vendor ThimPress and users of the Resca theme, in all versions up to and including 3.0.2, are affected. Any installation of the theme from its earliest release through version 3.0.2 is vulnerable. Users should check the currently active theme version and apply the update if available.

The flaw carries a CVSS score of 7.1 and an EPSS score below 1 %, indicating a moderate severity and a low likelihood of exploitation in the wild at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would typically trigger the flaw through a reflected vector, such as injecting malicious input into URL parameters or POST data that the theme displays without proper escaping. While automated exploitation is possible, the low EPSS suggests that large‑scale attacks are unlikely without a targeted effort.