The vulnerability is a reflected Cross‑Site Scripting flaw that permits an attacker to inject arbitrary JavaScript into web pages generated by the KALLYAS theme. If exploited, malicious code would run in the context of the affected site, potentially allowing data theft, session hijacking, or delivery of malware to unsuspecting visitors. The weakness is a classic CWE‑79 improper neutralization of input during web page generation.

The KALLYAS WordPress theme, distributed by Hogash, is affected in all releases up to and including version 4.25.0. Any WordPress installation that has a KALLYAS theme version in that range is vulnerable.

The CVSS score of 7.1 indicates a high impact with the exploitation requiring an end‑user to visit a crafted link or interact with malicious content. Although the EPSS score is not available, the lack of listing in the CISA KEV catalog suggests that there is no confirmed active public exploit at present. Nevertheless, the vulnerability remains a readily discoverable attack surface for attackers who can supply the malicious payload in a URL or form input.