The Reebox theme contains an improper input neutralization flaw that leads to reflected cross‑site scripting. When an attacker supplies malicious data via query strings or form inputs, the theme echoes that data directly into the page. This allows the attacker to embed and execute arbitrary JavaScript in a victim’s browser, potentially enabling session hijack, defacement, or data theft. The vulnerability carries a CVSS score of 7.1, indicating a high potential impact on confidentiality and integrity for users who view the affected pages.

Any WordPress site running the skygroup Reebox theme before version 1.4.8 is vulnerable. The issue applies to all installations that have not upgraded the theme to 1.4.8 or newer.

The CVSS score of 7.1 reflects a serious severity, and although EPSS data is unavailable, the flaw is publicly documented and not listed in CISA’s KEV catalog, suggesting an elevated risk of exploitation. Attackers can exploit the vulnerability via a crafted URL or input that is reflected back to the user; no authentication is required. Successful exploitation results in the attacker gaining the same privileges as the victim within the context of the site.