The vulnerability is an improper neutralization of user input during web page generation, allowing attackers to insert malicious scripts that are reflected back to the user in a browser. This reflected XSS flaw can be used to steal credentials, hijack sessions, or execute client‑side attacks, and it is categorized as CWE‑79. The flaw exists in NooTheme's Jobmonster WordPress theme.

Affected is the NooTheme Jobmonster theme. All versions available up through and including 4.7.8 are susceptible, while later releases are not listed as affected, implying the problem was resolved after 4.7.8.

The CVSS score of 7.1 indicates high severity, but the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in CISA's KEV catalog. Attackers would typically need to get a user to open a crafted URL or supply malicious input to a web form, so the attack vector is likely web‑based interactions involving site visitors.