Technical impact
This vulnerability stems from improper neutralization of user input during web page generation, leading to reflected cross‑site scripting. An attacker can inject malicious JavaScript that executes in the victim’s browser when they visit a crafted URL. The consequence is the ability to steal credentials, deface content, or redirect the user, affecting confidentiality, integrity, and availability of the website. The weakness is classified as CWE‑79 because it involves insufficient input sanitization in the rendering process.
Affected Systems
WordPress sites running GT3themes Diamond theme version 2.4.8 or earlier are affected. Versions prior to 2.4.8, from n/a through <= 2.4.8, contain the flaw. The issue does not extend to newer releases of the theme where the fix has been applied.
Risk and Exploitability
The CVSS score of 7.1 places this vulnerability in the high‑severity range. However, the EPSS score of less than 1 % indicates a very low probability that the vulnerability will be exploited at present, and it is not listed in the CISA KEV catalog. Likely exploitation would require an attacker to craft a malicious link that an unsuspecting user clicks, demonstrating that the vulnerability is user‑agent dependent. The risk hinges on the attacker’s ability to entice users to the crafted URL, so organizations that maintain heavily trafficked WordPress installations should treat it as a moderate risk.
