The vulnerability allows authenticated WordPress users with Contributor level or higher to store malicious scripts in the progressbarLayout parameter of the Kingcabs theme. When the stored value is later rendered on an affected page, any browser visiting that page will execute the injected script in the context of the site. This can lead to session hijacking, defacement, or distribution of malware to site visitors.

Kingcabs theme for WordPress versions 1.1.9 and earlier, provided by the vendor sparklewpthemes:Kingcabs. The issue resides in the progressbar block handling code. Any WordPress installation using one of these theme versions is affected.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score of less than 1% reflects a very low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the attacker to be an authenticated Contributor or higher user with permission to edit progress bar settings, making the attack vector internal. The attacker could, however, compromise the victim's session or steal user credentials if the injected script is used for phishing or keylogging. Based on the description, it is inferred that the attacker must first gain authorized access to the WordPress admin area to submit the malicious value.