OceanWP themes up to 4.2.7 include an improper neutralization of input during web page generation, enabling a reflected cross‑site scripting (XSS) flaw. The vulnerability permits a remote attacker to inject malicious JavaScript that will execute in the browsers of users who view affected pages. This can lead to session hijacking, defacement, or the delivery of further malware, impacting confidentiality, integrity and potentially availability of the site. The weakness is identified as CWE‑79.

The affected systems are WordPress deployments that use the OceanWP theme version 4.2.7 or earlier. The vendor is OceanWP and the product is the OceanWP theme for WordPress. The specific vulnerable versions extend from the initial release through 4.2.7.

The CVSS score of 7.1 indicates moderate to high risk, and the EPSS score is not available, so current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors include crafted URLs or form inputs that the theme processes without proper sanitization, enabling attackers to inject payloads that are reflected back to visitors who then run them in their browsers.