The Melos theme for WordPress contains a stored cross‑site scripting vulnerability that allows attackers to store malicious JavaScript content within the theme’s data structures. When a visitor renders a page or component that references that stored data, the attacker’s script runs in the victim’s browser. This can lead to theft of browser‑side credentials, session hijacking, defacement, or other actions that the script is able to perform.

Any WordPress site that has installed the ThinkUpThemes Melos theme version 1.6.0 or earlier is affected. Versions newer than 1.6.0 are not vulnerable.

The CVSS score of 6.5 categorises this flaw as moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalogue. Based on the description, it is inferred that an attacker must supply malicious content through a mechanism that the theme uses to persist data—such as posts, widgets, or custom fields—which is typically limited to users with content‑authoring or administrative privileges. Once the content is stored, any visitor who loads the affected page will have the injected script executed in their browser context.