Improper neutralization of user input during the generation of web pages, known as reflected cross‑site scripting, is present in the Foreverpinetree Thecs WordPress theme. Because the theme fails to escape data before rendering it, a visitor can cause the theme to inject arbitrary JavaScript into a page. This flaw allows an attacker to execute scripts in the context of any user who views a crafted page that the theme processes.

The vulnerability is present in all installations of the Foreverpinetree Thecs theme through version 1.4.7 inclusive. Site owners using the theme version 1.4.7 or older are affected.

With a CVSS base score of 7.1, this flaw is considered of high impact. The EPSS score indicates that exploitation is unlikely at present, with a probability below 1 %. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is client‑side; an attacker can trigger the vulnerability by delivering a crafted URL or form input that the theme displays without proper escaping. Exploitation requires no additional privileges and can affect any visitor who renders the vulnerable page.