An improper neutralization of user input during page generation allows attacker‑supplied scripts to be reflected back to a visitor’s browser. The flaw results in the execution of malicious code without the user’s knowledge and can be triggered whenever any input is echoed without proper escaping.

WordPress installations that use the Kutethemes Boutique theme in any version earlier than 2.4.6 are vulnerable. The issue applies to all releases from the theme’s initial launch up to version 2.4.5.

The CVSS base score of 7.1 classifies the vulnerability as high severity. No EPSS data is available, and it is not listed in the CISA KEV catalog. The flaw can be exploited by supplying crafted input—such as a URL parameter or form field—that is reflected without sanitization. Based on the description, it is inferred that the vulnerability can be triggered without authentication, making the risk moderate to high for any attacker who can deliver malicious input to a site visitor.