The vulnerability is an improper neutralization of user‑supplied input in the Golo WordPress theme that allows a reflected cross‑site scripting attack. An attacker can supply crafted payloads in URLs or form fields that the theme outputs without sanitization, enabling arbitrary JavaScript execution in the victim’s browser. The impact includes session hijacking, credential theft, and defacement of the site’s content.

WordPress sites that have installed the uxper Golo theme up to and including version 1.7.1 are affected. All earlier releases are also vulnerable as the theme’s input handling has not changed beyond that version.

The CVSS base score of 7.1 indicates a high‑severity vulnerability. The EPSS score is listed as < 1 %, suggesting a low probability of exploitation at this time, and the vulnerability is not present in CISA KEV. The likely attack vector is remote and requires user interaction with a crafted URL or input field. No authentication is required, making any visitor to the site potentially a target. Attackers could embed malicious scripts that run in the context of the site, gaining access to site cookies or sensitive information.