The vulnerability is an improper neutralization of input during web page generation that results in stored XSS. Malicious input can be saved and later executed in other users' browsers, enabling code injection, phishing, or session hijack. The weakness corresponds to CWE‑79.

The flaw exists in the ThimPress Eduma WordPress theme. All versions up to and including 5.7.6 are affected. No lower bound is provided, but the vulnerability applies to any installation using a version equal to or lower than 5.7.6.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is listed as <1%, implying a very low probability of exploitation in the near term. The vulnerability has not been recorded in the CISA KEV catalog. Attackers can target the theme via normal web interface, submitting crafted input that is stored and rendered to other visitors; the fix requires a theme upgrade. Without mitigation, an attacker who can inject content could execute arbitrary JavaScript in the context of any site visitor.