The vulnerability is an unauthenticated Cross Site Scripting flaw in the WordPress Grand Car Rental theme versions up to 3.7, allowing an attacker to embed arbitrary scripts that run when site visitors load the affected pages. The flaw, classified as CWE-79, means that untrusted input is not properly sanitized before rendering, potentially giving the attacker the ability to steal cookies, deface content, or perform phishing. Because the flaw is unauthenticated, it can be exploited by anyone who can load the vulnerable theme without having to log in.

The affected system is the Grand Car Rental WordPress theme supplied by ThemeGoods. Any installation of that theme with version 3.7 or earlier is susceptible; newer releases on the theme are presumed fixed.

The CVSS score of 7.1 indicates a high severity, yet the EPSS score of less than 1% suggests that actual exploitation attempts are currently rare. The issue is not listed in the CISA KEV catalog, which also points to lower immediate threat. The likely attack vector is a client‑side exploitation where an attacker crafts a malicious payload that is embedded into a page rendered by the theme, and disperses it through user visits to the affected site. Attack conditions are minimal: any visitor who loads the vulnerable page will run the injected script, so the risk to site owners is primarily the loss of user trust and possible data theft.