The KALLYAS WordPress theme allows stored cross‑site scripting via plugin shortcodes due to insufficient sanitization of user‑supplied attributes. An authenticated user with contributor or higher privileges can inject arbitrary JavaScript into pages, which will execute whenever any visitor loads the affected page. This enables attacks such as session hijacking, cookie theft, defacement, or malware delivery targeting site visitors.

The vulnerability affects the KALLYAS WordPress theme released by hogash, specifically versions up to and including 4.23.0. WordPress sites that have installed any of these theme versions are at risk. The hit list extends to all customers using the theme on their WordPress installations.

The CVSS score of 6.4 categorises the bug as a moderate‑severity stored XSS. The EPSS score of less than 1 % suggests that active exploitation has been rare to date, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated contributor‑level account; the attacker must first submit or edit content containing the malicious shortcode, after which any user who visits the page will have the injected script executed. Because the prerequisite is a legitimate login, this is a moderate‑risk threat that can be mitigated by disabling contributor privileges or restricting shortcode usage until the theme is updated.