The Logtik theme for WordPress contains an improper neutralization of input that allows reflected cross‑site scripting. An attacker can embed malicious JavaScript into a crafted URL or form field, which the theme then outputs without proper escaping. When a victim clicks the link or submits the input, the attacker’s code executes in the victim’s browser, enabling cookie theft, session hijacking, defacement, or redirection to malicious sites.

This vulnerability affects the venusweb Logtik theme version 2.3 and all older releases. The issue is present in any WordPress installation that uses Logtik up to, but not including, the next available update beyond 2.3.

With a CVSS score of 7.1 the vulnerability is considered medium‑high severity. The EPSS score of less than 1% indicates that active exploitation is currently rare, and the feature is not listed in CISA’s KEV catalog. The likely attack vector is a web‑based interaction that requires the user to open a crafted link or submit a form—generally requiring user engagement. If exploited, an attacker can run arbitrary scripts in the victim’s session and potentially compromise all data visible to that session.