The vulnerability is an Improper Neutralization of Input During Web Page Generation flaw that permits stored cross‑site scripting. When user‑provided input is incorporated directly into the consulting theme, malicious scripts can be embedded and served to any visitor that loads a page from the theme. The resulting client‑side script execution can alter the page as viewed by users.

Any WordPress site that runs the thinkupthemes Consulting theme version 1.5.0 or earlier is affected. The flaw resides solely in the theme code and does not depend on the underlying operating system, PHP version, or WordPress core version.

The CVSS score of 6.5 reflects moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is web‑based, whereby an attacker submits malicious input that is stored by the theme and later rendered to all site visitors.