The TieLabs Jannah WordPress theme up to version 7.6.0 contains a DOM‑Based Cross‑Site Scripting flaw that allows an attacker to inject and execute arbitrary JavaScript in a victim’s browser. By manipulating user‑controllable input such as URLs or form fields, the attacker can run code in the context of the site, potentially hijacking sessions, defacing content or delivering additional payloads.

Any WordPress installation using the TieLabs Jannah theme version 7.6.0 or earlier is affected. The vulnerability is reported to impact all releases from the earliest known version through 7.6.0.

The issue is assigned a CVSS score of 7.1 and an EPSS value of less than 1%, indicating a moderate severity but low probability of exploitation in the wild. Because the flaw is DOM‑Based, it requires a victim to visit a crafted page or interact with injected input, and it does not grant the attacker any privileged access on the server. The vulnerability is not listed in the CISA KEV catalog, and no widespread exploitation has been documented to date, yet the potential to affect users who visit malicious pages remains significant.