An improper input sanitization flaw in the Loobek WordPress theme allows attackers to inject arbitrary JavaScript via reflected user input, enabling cross‑site scripting. The flaw occurs whenever the theme outputs unsanitized query parameters or user data directly into the page. Successful exploitation would let an attacker run malicious code in the victim’s browser, potentially stealing authentication cookies, hijacking sessions, or modifying page content.

The vulnerability is present in all releases of the Loobek theme prior to version 1.5.2, distributed by skygroup. Systems using older versions of the theme, particularly on WordPress installations that have not applied the latest update, are affected.

The flaw carries a CVSS score of 7.1, indicating a high impact severity. No exploit probability data is available, and the vulnerability is not listed in the CISA KEV catalog. It is likely to be exploited through a standard reflected XSS attack vector, where an attacker crafts a malicious URL or input and lures a user to visit it. The ease of exploitation and potential for session hijacking make it a significant threat.