Improper neutralization of user-supplied data during web page generation allows an attacker to inject malicious script that executes in the target's browser. This reflected cross‑site scripting flaw (CWE‑79) can lead to session hijacking, cookie theft, defacement, or phishing attacks, compromising user confidentiality and site integrity.

All instances of the QantumThemes KenthaRadio wordpress theme dated n/a through version 2.2.0 are affected. The vulnerability is present in every release of the theme up to and including 2.2.0, regardless of other plugins or wordpress core versions.

The CVSS score of 7.1 classifies this as a high‑severity flaw, yet the EPSS score of less than 1 percent indicates the likelihood of exploitation is very low. The flaw is not listed in the CISA KEV catalogue, further reducing immediate threat. An attacker would craft a malicious URL or input that is reflected back into the page, so the attack requires a victim to visit the manipulated resource, typically via a phishing link or social engineering. When a user follows the crafted URL, the injected script runs with the privileges of the victim, allowing the attacker to steal data or perform malicious actions.