The vulnerability is an instance of improper neutralization of input during web page generation in the Zootemplate Cerato theme, classified as CWE‑79. Attackers can embed malicious JavaScript that is reflected back into the HTML response when a user visits a specially crafted URL. This reflected XSS allows arbitrary script execution in the victim’s browser. The CVE description does not detail further consequences; it is therefore inferred that the impact is limited to the user viewing the affected page.

WordPress sites that use the Zootemplate Cerato theme version 2.2.18 or earlier are affected.

With a CVSS score of 7.1 the vulnerability is moderate to high risk. The EPSS score is less than 1% indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is through a crafted URL that exploits the theme’s insufficient input sanitization; this would cause the reflected XSS payload to execute in the victim’s browser.