This vulnerability arises from improper neutralization of input during web page generation within the Blocksy theme, allowing attackers to store malicious scripts that execute when the page is rendered. A stored XSS can be used to hijack user sessions, deface content, or spread malware, impacting the confidentiality and integrity of users interacting with the affected site.

The issue affects the Blocksy theme for WordPress, versions up to and including 2.1.6. Any installation of those versions without a patch is vulnerable.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at the present time. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to inject malicious input into the theme’s processing flow, typically via a backend interface or content submission mechanism. Once injected, the script executes in the victim’s browser each time the affected page is loaded.