The vulnerability is an Improper Neutralization of Input During Web Page Generation that allows attackers to inject malicious script via URL parameters or form input. When a user visits a crafted link or submits data, the input is reflected directly into the page without proper escaping, enabling reflected XSS attacks that can lead to session hijacking, credential theft, or site defacement. The weakness is identified as CWE‑79.

The affected product is the Enzy theme from skygroup. All releases of the theme available before version 1.6.4 are vulnerable, including any custom builds or forks that have not applied the 1.6.4 fixes.

The CVSS score of 7.1 indicates a high potential impact, but the EPSS score of less than 1% suggests exploitation is unlikely at present and the vulnerability is not currently listed in the CISA KEV catalog. The most probable attack vector is a remote attacker delivering a crafted URL that is then opened by a site visitor using a browser that processes the reflected input. Successful exploitation requires a user interaction to trigger the malicious script.