The YOOtheme Pro WordPress theme versions prior to 5.0.35 allow users with the Author role to embed malicious JavaScript into post content. The theme’s bundled front‑end framework interprets certain HTML attributes that WordPress’s wp_kses_post() permits as markup, enabling the injected script to be stored with the post and executed in the browser of any visitor who views the affected content. This stored cross‑site scripting can lead to theft of session cookies, account hijacking, or arbitrary client‑side code execution. The potential for session cookie theft and account hijacking is inferred because stored XSS can execute arbitrary client‑side code.

The issue affects all WordPress sites that use YOOtheme Pro before version 5.0.35. Any user with the Author role on such a site can place the payload, and every other site visitor may be impacted when they load the compromised post. The vulnerability is independent of site size or traffic volume; the presence of the resource is required for exploitation.

The CVSS score of 6.8 indicates medium severity, while the EPSS score of less than 1 % suggests that exploitation is currently unlikely. The vulnerability does not appear in the CISA KEV catalog. Successful exploitation requires author‑level privileges to insert content; the attack vector is stored XSS via injection of malicious UIkit data attributes into post content, which is inferred from the CVE title and description. Based on the description, it is inferred that an attacker can leverage the stored script to steal session cookies or hijack accounts, as well as execute arbitrary client‑side code against site visitors.