The vulnerability is an improper neutralization of user input during web page generation, allowing reflected cross‑site scripting. This flaw permits an attacker to inject arbitrary JavaScript into pages served by WordPress sites that use the skygroup MyMedi theme. Executed scripts run in the victim’s browser, potentially altering the page display or accessing client‑side data.

All WordPress sites that have installed the skygroup MyMedi theme prior to version 1.7.7 are impacted. This includes every release from the theme’s earliest available version up to, but not including, 1.7.7. No specific build or deployment details are provided.

The CVSS score of 7.1 indicates high severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is via a crafted URL or form that the theme reflects. Exploitation requires no special privileges and can be carried out by anyone who accesses a malicious link or submits a malicious form.