The SmartMag theme contains a stored cross‑site scripting flaw that allows unfiltered user input to be rendered in generated web pages. An attacker who can submit content that the theme outputs unsanitized can cause a victim’s browser to execute arbitrary JavaScript, potentially stealing session data or performing actions on behalf of the user. The weakness is a classic input validation failure, identified as CWE‑79.

The vulnerability affects the ThemeSphere SmartMag WordPress theme, all releases from the original introduction through version 10.3.1. Any WordPress site that has this theme installed in a vulnerable version is at risk.

The CVSS score of 6.5 indicates a medium‑to‑high severity, while the EPSS score of less than 1 % points to a low exploitation probability in the current threat landscape. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to insert malicious content that the theme later displays; while authentication details are not explicitly stated, the typical stored XSS flow suggests the attacker may need some level of access to submit data that is saved by the theme. Once satisfied, any user browsing pages that render the unsanitized input will be subject to the injected script.