Technical impact
The ArtstudioWorks Brookside theme is vulnerable to an improper neutralization of input during web page generation that results in reflected cross‑site scripting (CWE‑79). When a user supplies crafted data that the theme echoes back without adequate encoding, an attacker can inject arbitrary JavaScript into the victim’s browser. This enables information theft (such as session cookies), phishing, or execution of malicious scripts in the context of the site’s domain. The impact is limited to the web pages rendered by the vulnerable theme and does not grant server‑side access.
Affected Systems
ArtstudioWorks Brookside theme is affected for all released versions from the first available version up through 1.4. No specific patch version is listed; therefore, any deployment of Brookside <= 1.4 is considered vulnerable.
Risk and Exploitability
The CVSS score of 7.1 indicates a high severity level for a reflected XSS vulnerability. Exploitability is likely high because the flaw can be triggered by any user visiting a crafted URL or interacting with a reflected form field. The EPSS score is < 1%, indicating a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can generally exploit this flaw by simply visiting a malicious URL; no elevated privileges or authentication are required.
