The DeepDigital WordPress theme contains an improper neutralization of script‑related HTML tags that permits attackers to inject malicious code into a page through the theme’s shortcode processing. This results in a Basic XSS flaw, allowing client‑side code to be executed when the affected page renders. If an attacker can place malicious shortcode content, browsers will interpret the injected scripts, leading to potential defacement, session hijacking, or other XSS‑related compromises. The weakness is identified as CWE‑80.

All sites that use the mwtemplates DeepDigital theme version 1.0.2 or earlier are vulnerable. The issue applies to any installation that has not yet upgraded beyond that release; site administrators should verify the theme version in use.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1 % demonstrates a very low likelihood of exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via a web interface that accepts user‑supplied content, such as the post editor or form submission, where the attacker can embed a malicious shortcode. Successful exploitation would require the ability to insert or modify page content, after which the injected script can run in visitors’ browsers.