The vulnerability is an instance of improper input neutralization that results in reflected Cross‑Site Scripting. An attacker can craft a URL that includes malicious JavaScript; when an affected user visits that URL, the script runs in the victim’s browser with the same privileges as the user view. This can lead to theft of session cookies, defacement of content, or the execution of arbitrary code on the client side. The weakness is categorized as CWE‑79, which highlights the lack of sanitization in generating the response page.

The issue affects the ThemeGoods Grand Tour WordPress theme for all versions from initial release through versions lower than 5.6.2. Users running any of those pre‑5.6.2 releases are vulnerable; newer or patched releases are not affected.

The CVSS score of 7.1 denotes high severity, and the EPSS score indicates a very low probability of mass exploitation at present. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the most likely attack vector is a reflected XSS attack triggered via a maliciously crafted link sent to unsuspecting users. Successful exploitation requires the victim to click the link and view the resulting page, after which client‑side code executes.