The flaw is an improper neutralization of input during web page generation that allows attackers to inject malicious JavaScript that is reflected back to the victim. This Reflected XSS can execute arbitrary code in the context of the target site, potentially leading to session hijacking, defacement, or phishing. The weakness is a classic input‑validation flaw identified as CWE‑79 and requires no authentication to trigger. An attacker can exploit it by delivering a crafted URL or form to a user of the vulnerable WordPress site.

The vulnerability affects the XStore Core WordPress plugin provided by 8theme. All releases of the plugin prior to version 5.6 are susceptible. Any WordPress site that has not upgraded beyond 5.5.x or earlier is at risk.

The CVSS score of 7.1 indicates high impact, but the EPSS score of less than 1 % suggests a very low current exploitation probability. The flaw is not yet listed in the CISA KEV catalog. Attackers can exploit it through the web interface by getting a user to visit a crafted URL or submit a malicious form; no additional privileges are required, making it a low‑barrier attack vector.