The vulnerability originates from the Circle Counter Block in the Educenter theme for WordPress. Insufficient input sanitization and output escaping allow an attacker with Contributor or higher authority to insert arbitrary scripts into posts. When a user views a page that contains an injected block, the script executes within that user’s browser, enabling the attacker to run arbitrary client‑side code on any visitor to the infected page.

All installations of the Educenter theme version 1.6.2 and earlier on WordPress sites, distributed by SparkleWP Themes.

The CVSS score is 6.4, reflecting moderate risk. The EPSS score is below 1 %, indicating a very low probability of exploitation at present. This flaw is not listed in the CISA KEV catalog. An attacker must be authenticated with at least Contributor rights and exploit the block editor to insert malicious code; once injected, the payload persists in the post and is delivered to all visitors of that page.