The flaw arises from the BuddyApp theme’s failure to neutralize user input before rendering it in the page, enabling an attacker to inject scripts that are reflected back to the victim when the manipulated URL is accessed. This can result in execution of arbitrary client‑side code in the context of the site and compromise the victim’s browser session.\n\nThe weakness is identified as a classic reflected XSS flaw (CWE‑79).

WordPress installations that use the BuddyApp theme from its earliest available release through any version up to and including 1.9.2 are impacted. The theme is developed by SeventhQueen.

The CVSS score of 7.1 places the vulnerability at medium severity. An EPSS score of less than 1% indicates that the likelihood of exploitation in the near term is low, and the issue is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Likely exploitation would involve an attacker crafting a malicious URL containing user input that is reflected back to the victim; no privileged access or additional conditions are required.