The Woostify theme contains an improper neutralization of input during web page generation that allows the storage of malicious scripts. An attacker can embed JavaScript that is executed whenever a page using the theme is rendered, enabling phishing, credential theft, or content defacement. This flaw is a classic stored XSS vulnerability, classified as CWE‑79, and undermines the integrity of content displayed to end users.

Any WordPress installation that includes the Woostify theme, version 2.4.2 or earlier. Sites that have not upgraded beyond version 2.4.2 or applied a vendor fix remain affected.

The vulnerability carries a CVSS score of 5.9, indicating medium severity, and an EPSS score of less than 1 %, indicating a low probability of exploitation in the near term. It is not listed in the CISA KEV catalog. The likely attack vector is through the website’s content management interface, where an attacker who can submit or otherwise influence content managed by the theme can insert persistent malicious code that will be rendered for all subsequent visitors. Despite the low exploitation likelihood, the potential damage from a successful XSS remains significant.