The Jaroti theme for WordPress contains an improper neutralization of input during web page generation that allows an attacker to inject malicious scripts into a page that is then served to users. This reflected XSS flaw can enable attackers to run arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, credential theft, or defacement of the site. The weakness corresponds to a typical cross‑site scripting flaw (CWE‑79).

This vulnerability affects the Jaroti theme from skygroup, versions less than 1.4.8. Any installations of the theme running those versions are exposed; newer releases (1.4.8 and later) are not affected.

The CVSS score of 7.1 indicates a moderate to high severity. EPSS data is unavailable, and the vulnerability is not listed in CISA's KEV catalogue, suggesting no known widespread exploitation yet. The likely attack vector is a reflected XSS, triggered by a malicious link or crafted URL that a user clicks while the theme is active. The flaw requires the user to visit a page that includes the vulnerable theme; no authentication or privileged access is necessary.