The vulnerability involves improper neutralization of user input during web page rendering, enabling reflected cross‑site scripting in the WorkScout WordPress theme. This flaw allows an attacker to inject malicious scripts through crafted requests, potentially executing within the victim’s browser, stealing credentials, or defacing content. The weakness is a classic input validation issue, identified as CWE‑79.

Purethemes’ WorkScout theme versions from the earliest release through version 4.1.07 are affected. Any WordPress installation employing these theme releases is susceptible unless newer, unpatched releases are in use.

With a CVSS score of 7.1, the vulnerability represents a medium to high severity risk. The EPSS score is below 1 % and the flaw is not listed in CISA’s KEV catalog, indicating rare exploitation in the wild. The likely attack vector is a reflected XSS, triggered via user‑controllable query parameters or form fields rendered by the theme. Exploitation requires only a crafted URL or form payload; no privileged access is needed.