This vulnerability is an improper neutralization of input during web page generation, allowing reflected XSS within the Grand Restaurant theme. An attacker can embed malicious scripts in URLs or input fields that are reflected back to the browser, potentially leading to cookie theft, session hijacking, defacement, or malicious code execution within the context of the site.

All WordPress sites that employ the ThemeGoods Grand Restaurant theme in a version earlier than 7.0.9 are affected. The theme is distributed through the WordPress ecosystem under the ThemeGoods brand and is commonly found in restaurants and hospitality websites that rely on it for their front‑end presentation.

The CVSS score of 7.1 marks the vulnerability as high severity. The EPSS score of less than 1% indicates a low probability of widespread exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the delivery of a crafted URL or form input that the theme reflects without proper sanitization, giving the attacker an opportunity to inject JavaScript into the user’s browser.