The vulnerability is a reflected XSS caused by improper input neutralization in ThemeMakers Car Dealer theme. A crafted request can inject JavaScript that executes in the victim’s browser. This allows an attacker to steal cookies, hijack user sessions, or perform malicious actions while the user is logged in. The impact is on confidentiality and integrity of user data and can lead to further compromises such as phishing or credential theft.

The issue affects WordPress sites that have the Car Dealer theme from any unreleased version through version 1.6.7. The vendor is ThemeMakers and the product is the Car Dealer theme.

The CVSS score of 7.1 indicates moderate to high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but XSS remains a common exploitation vector. The likely attack vector is an innocent user clicking a malicious URL or link. No special authentication or privilege is required, so any user visiting the site is a target. Given the widespread use of the theme, the risk of exploitation is significant for affected sites.