This vulnerability allows attackers to execute arbitrary JavaScript in the context of a website visitor who loads a page containing the vulnerable theme. The flaw arises from improper neutralization of input during web page generation, as defined by CWE-79. Successful exploitation could lead to session hijacking, credential theft, malware delivery, or defacement of the site by a malicious user with no special privileges.

The GT3themes SOHO - Photography WordPress Theme is affected in all releases from the earliest published version up to and including 3.0.3. Users running WordPress with any of these theme versions are vulnerable.

The CVSS score of 7.1 reflects a moderately high risk, while the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote: a malicious actor can deliver a crafted link or embed that, when a site visitor’s browser renders the affected page, executes arbitrary JavaScript in the visitor’s context. Because the flaw is DOM‑based, the attack requires the victim to view the vulnerable page in a modern browser.