This vulnerability is an improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that execute in the context of a victim's browser. The reflected XSS can lead to theft of session cookies, defacement, or execution of arbitrary code on the client side. The weakness corresponds to CWE‑79 and has a CVSS score of 7.1, indicating moderate to high risk for affected WordPress sites.

The XStore theme from 8theme is vulnerable for all releases prior to version 9.6.1. WordPress sites using any such version of the theme are at risk. No additional vendor or product variations are listed beyond the theme itself.

The EPSS score is below 1%, indicating a low probability of exploitation, and the vulnerability is not listed in any CISA KEV catalog. Based on the description, it is inferred that attackers can trigger this reflected XSS by sending a crafted URL or submitting a form that includes malicious input through the theme’s interface; no additional privileges are required. The vulnerability can affect any visitor to the site, potentially compromising session data, defacing content, or loading malicious scripts. Given the CVSS score of 7.1, the risk remains moderate to high for sites with high traffic or many user interactions.