Improper neutralization of user‑supplied input during web page generation enables reflected XSS in the DeepDigital WordPress theme. The flaw allows an attacker to inject malicious code that executes in the victim’s browser. The weakness is a Classic Input Validation failure (CWE‑79).

The vulnerability affects the DeepDigital theme from mwtemplates, impacting all installations using version 1.0.2 or earlier. No later versions are listed as vulnerable.

The CVSS score of 7.1 indicates high severity. EPSS is below 1 %, suggesting a low likelihood of exploitation at this time, and the issue is not listed in the CISA KEV catalog. The likely attack vector involves delivering a crafted URL or input that is reflected without proper encoding, making it exploitable by any user who visits the malicious link or submits the malicious input. The impact is limited to the victim’s browser.