Improper handling of user input during page rendering in the GoStore theme allows reflected XSS, meaning a malicious script can be injected into the page that is immediately reflected back to a victim’s browser. An attacker can execute JavaScript in the victim’s context, potentially hijacking sessions, stealing cookies, defacing content, or delivering malware. This weakness is categorized as CWE‑79.

The vulnerability affects the GoStore theme by skygroup, used within WordPress sites, any release from the initial version up to, but not including, 1.6.4. Any installation running a pre‑1.6.4 version is potentially impacted.

The CVSS score of 7.1 indicates high severity, yet the EPSS score is below 1%, suggesting that exploitation is currently rare and the vulnerability is not yet widely targeted. The issue is not listed in the CISA KEV catalog. While the XSS flaw is observable only in a requested page that includes crafted input, it can be triggered by a malicious link that a user might click, meaning the attack still requires the victim’s interaction. Overall the risk is significant for confidentiality and integrity of user sessions, but the low exploitation probability and lack of widespread evidence reduce the immediate threat posture for environments that have not yet applied the 1.6.4 fix.