The vulnerability allows an attacker to inject and execute arbitrary client‑side scripts in the browser of any visitor who loads a specially crafted URL or form submission. This can lead to session hijacking, credential theft, defacement or delivery of malware to users, compromising confidentiality and the integrity of the site’s displayed content.

WordPress sites using the GhostPool Aardvark theme, versions up to and including 4.6.3, are affected. The flaw resides in the theme’s handling of user‑supplied input when generating web pages.

The CVSS score of 7.1 and an EPSS score of < 1% indicate a high severity but a low probability of widespread exploitation at present. The Aardvark theme is not listed in the CISA KEV catalog. The likely attack vector is via reflected XSS, where an attacker supplies malicious payloads in query parameters or form fields that are reflected back without proper sanitization."