Improper neutralization of user input during page generation in Select‑Themes Stockholm enables stored cross‑site scripting. Attackers can embed malicious JavaScript into theme content that will execute automatically when visitors view the page, potentially leading to credential theft, session hijacking, defacement, or redirection. This weakness is classified as CWE‑79.

The vulnerability affects the Stockholm theme developed by Select‑Themes. All releases through version 9.14.1 are vulnerable. Any WordPress installation using these versions must be considered at risk until the theme is updated. Versions newer than 9.14.1 are not known to be affected.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, implying no publicly disclosed exploit code exists at present. Attackers would need to inject malicious content via the administrators’ interface or another privileged user input mechanism to store the script, suggesting the attack vector is likely internal content management. Given the moderate risk, monitoring for anomalous script injection attempts and promptly applying the available patch is advisable.