Unauthenticated Cross Site Scripting (XSS) has been identified in the Qreatix WordPress theme up to version 1.9.4. The flaw allows an attacker to inject malicious scripts into web pages served by the vulnerable theme. This can lead to defacement, credential theft, or session hijacking for site visitors. The weakness is catalogued as CWE‑79, indicating improper handling of user-supplied input in output contexts.

Systems running the Qreatix theme version 1.9.4 or earlier on WordPress installations are affected. The specific vendor is jkdevstudio, and the product is the Qreatix theme.

The CVSS score of 7.1 indicates a high severity. The EPSS score is below 1%, suggesting that widespread exploitation is currently unlikely, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Nonetheless, because the attack requires no authentication, an attacker can compromise any site that deploys the affected theme by simply embedding malicious code. The typical attack vector is through a comment, custom post text, or other user‑submitted fields rendered by the theme.