Improper neutralization of user input during page generation allows attackers to inject malicious scripts that are reflected back to a victim’s browser. This reflected XSS flaw can be used to steal session cookies, deface the site, or distribute malware, and it exemplifies the CWE‑79 weakness of input unneutralization.

The vulnerability impacts the Thebe WordPress theme developed by Forever Pine Tree. All versions from the earliest available up to 1.3.0 are affected. No information is provided for later releases, so site administrators should verify whether newer themes patch this issue.

The CVSS v3 score of 7.1 indicates moderate to high severity. The EPSS score of <1 % suggests a low probability of widespread exploitation at present. The flaw is not listed in the CISA KEV catalog and no public exploits have been reported. Because reflected XSS can be triggered via crafted URLs handled by the theme, any visitor who follows a malicious link could be compromised. The attack vector is inferred to be through user‑supplied input such as query parameters or request data.