Improper neutralization of input during web page generation in the Golo theme allows reflected Cross-site Scripting (XSS). A malicious actor can send crafted input that is echoed back to the victim's browser, enabling execution of arbitrary JavaScript.

WordPress sites that use the Golo theme prior to version 1.7.5 are affected; the vulnerability applies to every release from the earliest unavailable through any version less than 1.7.5.

The CVSS base score of 7.1 indicates high severity. No EPSS score is reported and the issue is not listed in CISA’s KEV catalog. The likely attack vector is a public web request that includes malicious query parameters or form data processed by the theme without adequate sanitization, requiring the victim to visit a crafted URL.