Improper neutralization of user input during web page generation allows an attacker to inject malicious scripts that run in the victim’s browser. This reflected cross‑site scripting can lead to unauthorized data disclosure, cookie theft, session hijacking or manipulation of the webpage content, affecting confidentiality, integrity and potentially availability when the script disrupts user interaction.

The vulnerability affects the WordPress Miti theme developed by skygroup. All installations running any version prior to 1.5.3 are impacted; the highest affected version is identified as any release earlier than 1.5.3.

The CVSS score of 7.1 indicates a high risk level. Exploit potential is not quantified by an EPSS score, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through crafted URLs or input fields that are reflected in page output, so a remote attacker can trigger the XSS by visiting a malicious link. The impact is scoped to users who view the affected page, giving attackers the ability to test or execute scripts within the victim’s browser context.