The vulnerability is an improper neutralization of input during web page generation, allowing a reflected XSS attack. An attacker can supply specially crafted data that is echoed back in the web page, enabling execution of arbitrary JavaScript in the victims' browsers. This can lead to cookie theft, session hijacking, defacement, or malicious content injection—critical risks for confidentiality, integrity, and availability of the affected WordPress site.

WordPress sites using the ThemeHunk Customizer plugin version 2.8.7 or earlier are affected. The issuer of the affected product is ThemeHunk, and the vulnerability applies to all installations of the ThemeHunk Customizer themehunk-customizer plugin in the specified version range.

The CVSS score of 7.1 indicates a high severity. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be reflected via crafted input without the need for authentication, making exploitation straightforward and likely to occur in the wild when the plugin is deployed.