The vulnerability is an improper neutralization of input during web page generation that allows attackers to store malicious scripts in the Shuttle theme. When the content is later rendered those scripts execute in visitors’ browsers, potentially enabling session hijacking, credential theft, or defacement. This weakness corresponds to CWE‑79.

The issue affects the Shuttle theme released by shuttlethemes, versions from the initial release up to and including 1.5.0. Any WordPress installation using those versions is vulnerable.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score of less than 1% suggests that the probability of exploitation is low at present. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw permits stored cross‑site scripting, attackers likely need to submit malicious content through the theme’s input interfaces, which is then saved to the database and served to other users. Based on the description, it is inferred that an attacker can trigger the execution of malicious scripts by having others visit affected pages, potentially bypassing access controls.