An improper neutralization of user‑supplied input in the Prestige theme creates a reflected cross‑site scripting flaw. The flaw allows an attacker to embed arbitrary JavaScript in pages served to victims, which can lead to cookie theft, credential compromise, or defacement. The weakness is a classic input‑validation issue classified as CWE‑79.

WordPress users who have installed the Prestige theme—whether through the JThemes package or any installation method—are vulnerable if they are using any release prior to 1.4.1. No higher version is affected, and the vulnerability applies to every occurrence of the theme in sites using those older versions.

The vulnerability carries a CVSS score of 7.1, indicating a high impact if exploited. However, the EPSS score is less than 1 %, suggesting that exploitation is unlikely at this time, and the flaw has not been listed in CISA’s KEV catalog. Attackers would need to lure a victim’s browser to a crafted URL that reflects back unsanitized input, a scenario that can be mitigated by moving to a patched theme or by applying broader input filtering. In the absence of a publicly known exploit, the risk remains moderate, but the potential for credential theft warrants immediate action.