The vulnerability arises from improper neutralization of user input during web page generation in the CridioStudio ListingPro theme. An attacker can inject malicious JavaScript that is reflected back into the page, enabling a classic Reflected XSS attack. This flaw could allow session hijacking, theft of sensitive data, or defacement of the site’s UI. The issue is classified as CWE-79.

WordPress sites that employ the ListingPro theme from CridioStudio running any version prior to 2.9.10 are affected. The theme failed to escape certain query parameters and output paths, so all users of these older releases are potentially vulnerable.

The CVSS score of 7.1 indicates a high severity and the CWE-79 classification. The EPSS score of less than 1 percent suggests that actual exploitation is currently uncommon, and the vulnerability is not listed in CISA’s KEV catalog, implying a lower likelihood of targeted attacks. Based on the description of a reflected XSS flaw, a typical exploitation scenario is inferred to require a user to visit a specially crafted URL, so the risk is broadened to any user following such a link. This inference comes from the nature of the flaw and is not directly stated in the CVE data.