The vulnerability is a Cross‑Site Scripting flaw—specifically, improper neutralization of input during web page generation—allowing reflected XSS. An attacker can inject malicious scripts that run in the victim’s browser, potentially hijacking sessions, stealing cookies, defacing content, or executing other client‑side attacks. The flaw is identified as CWE‑79 and directly compromises the confidentiality and integrity of user data accessed through the site, with secondary availability effects if scripts disrupt page rendering.

All instances of the 8theme.com XStore WordPress theme running any version prior to 9.7.9. The theme, common on e‑commerce sites, is susceptible to exploitation if not updated. No additional product or operating‑system specifics are provided.

The CVSS score of 7.1 indicates moderate severity, while an EPSS score of less than 1% reflects a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is reflected input—attacker passes crafted data via URLs or form fields that the theme echoes in the HTML output. No authentication is required, so every user visiting a vulnerable page could be exposed to the XSS payload.