The vulnerability is an improper neutralization of input during web page generation, allowing a reflected cross‑site scripting (XSS) attack. When a user visits a specially crafted URL or submits a URL-parameter containing JavaScript code, the theme outputs the data without adequate escaping, leading to execution of the attacker’s script in the victim’s browser. This can enable cookie theft, session hijacking, defacement, or other client‑side manipulation.

WordPress sites that use the ThemeGoods DotLife theme in any version prior to 4.9.5 are affected. The issue spans all releases from the theme’s earliest public version through the last unpatched release specific to these versions.

The CVSS score of 7.1 indicates medium severity, and the EPSS score of <1% shows that the likelihood of exploitation is low as of the present analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through a reflected user‑controlled input—in particular, an attacker can embed malicious scripts in a query string or other input field that the theme renders without sanitization. No authentication is required, and any site visitor can trigger the exploit by accessing the crafted URL.