The vulnerability resides in the CarSpot WordPress theme prior to version 2.4.6. Improperly filtered input is reflected back into the generated web page, allowing an attacker to embed arbitrary client‑side code when a user follows a crafted link or enters data that is later displayed. If exploited, the attacker can steal user data, hijack sessions, or perform other malicious actions directly within the victim’s browser.

All WordPress installations that use scriptsbundle CarSpot theme versions older than 2.4.6 are susceptible. The vulnerability applies to every release from the theme’s earliest available build up through 2.4.5 inclusive.

The CVSS score of 7.1 classifies the flaw as high severity. The current EPSS score is below 1 %, indicating a low probability of exploitation at present. The vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation. The likely attack vector would involve a remote user delivering a specially crafted URL or input to a vulnerable site, exploiting the reflected XSS to inject scripts into the victim’s browser.