The Appzend WordPress theme contains a stored cross‑site scripting flaw in the progressbarLayout parameter. Because the input is not sanitized and the output is not escaped, an attacker who has authenticated Contributor‑level or higher permissions can inject arbitrary JavaScript that will be saved and rendered whenever a page containing the affected block is viewed. This flaw allows the attacker to run malicious code in the browsers of anyone who visits the injected page.

All installations of the Appzend theme from sparklewpthemes up to and including version 1.2.6 are affected. Any WordPress site that deploys this theme and permits Contributors or higher to edit the progressbar block is vulnerable. The risk exists only on sites that have a user with sufficient role privileges and do not otherwise restrict that capability.

The CVSS score of 6.4 indicates medium severity. The EPSS score of < 1% suggests a very low probability of exploitation at present, and the vulnerability is not listed in CISA's KEV catalog. However, because the flaw requires authenticated access, attackers need a valid Contributor or higher account, which may exist on many sites. If such a user could gain additional privileges or the site is exposed to social‑engineering attacks, the stored scripts could compromise confidentiality or integrity of the site or its visitors.