The vulnerability is an instance of Improper Neutralization of Input During Web Page Generation. It allows an attacker to embed malicious script into an otherwise legitimate page, leading to reflected XSS. When a user visits a specially crafted URL or clicks a link, the script is executed in the victim’s browser. This can result in theft of session cookies, credential hijacking, defacement, or redirection to malicious sites. The weakness is classified as CWE‑79.

Affected are WordPress sites that use the CleverSoft Anon theme version 2.2.10 or earlier. No other versions are affected. The flaw is present across all releases up to and including 2.2.10 of the theme. Site administrators that have installed this theme must confirm the running version and address accordingly.

The CVSS score of 7.1 indicates a high level of severity for an XSS flaw. However, the EPSS score is below 1%, showing that the exploitation is unlikely in the wild and the vulnerability is not currently part of any known attack campaigns. The flaw is not listed in the CISA KEV catalog. Generally, an attacker would need to lure a user to a crafted URL or exploit a link within a page; no authentication or privileged access is required. Because it is a reflected XSS, it does not provide remote code execution but can still be a gateway to more damaging attacks if the user’s session is hijacked.