This vulnerability is an Improper Neutralization of Input During Web Page Generation flaw that allows attackers to inject malicious JavaScript into a page that is displayed to a user. The flaw is identified as a reflected XSS and is categorized under CWE‑79. A successful exploit could let an attacker execute arbitrary scripts in the context of a visitor’s browser, potentially compromising user sessions, defacing the site, or redirecting users to malicious destinations.

The Grand Conference theme from ThemeGoods, versions up to and including 5.3.4, are affected. No additional vendor or product versions are listed, so any site running the theme at or below 5.3.4 should be considered vulnerable.

The publicly available CVSS score is 7.1, indicating a high‑severity impact. The EPSS score is less than 1%, suggesting a very low probability of exploitation in the wild at the time of this analysis, and the vulnerability is not currently listed in CISA’s KEV catalog. The most likely attack vector is untrusted user‑supplied data that the theme reflects back in the rendered page, as is typical with reflected XSS. An attacker would need to trick a victim into visiting a crafted URL or submitting malicious input that the theme processes and displays without proper sanitization.