The vulnerability arises from improper neutralization of input during web page generation in the Hostiko WordPress theme, enabling reflected cross‑site scripting. An attacker can embed malicious scripts in certain user‑controllable input that is rendered directly to the browser, potentially hijacking user sessions, defacing content, or executing further attacks in the victim’s context.

All installations of the Hostiko theme for WordPress with a version prior to 94.3.6 are affected. This includes any website that has deployed Hostiko before the release of version 94.3.6, regardless of WordPress core version.

The CVSS score of 7.1 indicates a moderate to high impact potential, while the EPSS score of < 1% signals a low likelihood of exploitation in the near term. The vulnerability does not require authentication and can be triggered by manipulating reflected input, making it straightforward for an attacker to craft a malicious URL or form that activates the XSS payload. Although it is not listed in CISA's KEV catalog, the straightforward attack vector warrants prompt mitigation.