The vulnerability is an improper neutralization of input during web page generation, allowing attackers to inject and execute arbitrary script code in the context of a victim’s browser. This reflected XSS flaw can enable attackers to steal session cookies, deface content, or redirect users, thereby compromising confidentiality and integrity of user data.

The issue affects the WordPress XStore Core plugin, used by 8theme XStore Core. All releases from the earliest available version up to and including version 5.6.4 are vulnerable.

The CVSS score of 7.1 indicates a high likelihood of exploitation if a user visits a maliciously crafted URL. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, suggesting it is not a known exploit but could be discovered given the high score. Attackers typically construct a URL containing the malformed parameter that leads to script execution; no special privileges or additional conditions are required to exploit the flaw.