The vulnerability arises from improper input neutralization during web page generation, enabling an attacker to inject malicious scripts into pages rendered by the DesignThemes Core plugin. This defect can lead to execution of arbitrary JavaScript in the context of a victim’s browser, potentially compromising session cookies, defacing content, or phishing users. The weakness is classified as CWE‑79 and is limited to user‑controlled content within the plugin’s output.

WordPress sites running the DesignThemes Core plugin version 1.6 or earlier are affected. The plugin is distributed by the vendor DesignThemes under the product name DesignThemes Core.

The CVSS score of 6.5 reflects moderate severity. The EPSS score is below 1%, indicating a low probability of exploitation at the moment. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to visit a page that renders unsanitized, attacker‑controlled data, implying that the attack vector is web‑based and that the attacker can leverage the site’s existing content to deliver malicious payloads.