The vulnerability is a reflected cross‑site scripting flaw caused by improper input handling in the ThemeGrill eStore theme up to version 1.6.13. An attacker who can influence request parameters that are subsequently echoed in the browser can inject HTML or JavaScript, potentially compromising the integrity of the victim’s session and allowing credential theft, defacement, or data exfiltration. The weakness is classified as CWE‑79, a classic unescaped output problem.

WordPress sites using the ThemeGrill eStore theme, versions earlier than or equal to 1.6.13. The theme is delivered by ThemeGrill and is popular in the WordPress ecosystem.

The CVSS score of 7.1 indicates a high severity for cross‑site scripting. Because the EPSS score is unavailable, the probability of exploitation is unclear, but the issue is publicly documented on PatchStack. It is not listed in the CISA KEV catalog, so no known mass exploitation has been reported. The likely attack path is through any request that passes user-supplied content to the front‑end, typical of a reflected XSS exploitation scenario. Administrative login and authenticated sessions remain protected by WordPress defaults unless the attacker also manages to obtain a valid session cookie.