The vulnerability exists in Dream‑Theme The7 and occurs when user supplied input is not properly neutralized during web page generation. This DOM‑based XSS allows attackers to inject malicious JavaScript by crafting a URL or input that is then rendered by the page. An attacker who succeeds can hijack user sessions, deface the site, or redirect visitors to malicious domains.

All installations of The7 theme versions earlier than 12.9.0, including 12.8.0 and older, are affected. The product is the WordPress theme distributed by Dream‑Theme under the CNA listing Dream‑Theme: The7.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of <1% suggests a low probability of exploitation in the wild. The vulnerability is not present in the CISA KEV catalog. An attacker only needs to supply a crafted request or lure a user to a manipulated URL, as the flaw is triggered by any user who accesses the vulnerable page. No special privileges are required.