This vulnerability is a Basic XSS flaw that allows an attacker to inject script‑related HTML tags into a WordPress XStore theme, resulting in content injection. The improper neutralization of user‑provided input means malicious scripts can execute in the context of page visitors, potentially enabling defacement, credential theft, or further compromise.

The flaw affects all released editions of the 8theme XStore theme prior to version 9.6, regardless of the specific sub‑release. Users running any earlier theme build are potentially exposed.

With a CVSS base score of 5.3, the risk is moderate. The EPSS score of less than 1 % indicates a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers can likely deliver the payload through any administrator or customizer interface that accepts unescaped HTML, meaning the exploit path requires remote access to the site’s backend or an exposed input that accepts arbitrary markup.