The Brookside theme contains improper neutralization of input during web page generation, resulting in a reflected cross‑site scripting (XSS) vulnerability (CWE‑79). When a user supplies specially crafted data that is echoed back by the theme without proper encoding, an attacker can inject arbitrary JavaScript into the victim’s browser. This can lead to information theft (e.g., session cookies), phishing attacks, or the execution of malicious scripts in the context of the site’s domain. The impact is confined to the web pages rendered by the vulnerable theme and does not provide direct server‑side access.

ArtstudioWorks Brookside theme is affected for all released versions from the first available version up through 1.4. No specific patch version is listed; therefore, any deployment of Brookside <= 1.4 is considered vulnerable.

The CVSS score of 7.1 indicates a high severity level for a reflected XSS vulnerability. Exploitability is likely high because the flaw can be triggered by any user visiting a crafted URL or interacting with a reflected form field. The EPSS score is unavailable, and the vulnerability is not reported in the CISA KEV catalog. Attackers can generally exploit this flaw by simply visiting a malicious URL; no elevated privileges or authentication are required.