An attacker can inject malicious script into the Theater for WordPress plugin, which is then stored and served to any user who views the affected page. The stored XSS flaw allows arbitrary JavaScript execution within the victim’s browser, potentially leading to session hijacking, credential theft, or defacement. The weakness is a classic type of input validation failure, documented as CWE‑79.

The vulnerability affects the Theater for WordPress plugin by Jeroen Schmit version 0.19 and all earlier releases. Administrators should verify whether their site runs this plugin version and consider it exposed until a patch is applied.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% shows the estimated exploitation probability is very low at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply arbitrary input that is accepted and rendered by the plugin, such as via user comments, post content, or widget fields. When such input is loaded, the browser executes the embedded script, compromising the victim’s session and data.