The Sanzo WordPress theme contains a stored cross‑site scripting flaw that permits an attacker to inject HTML or JavaScript into content that is stored by the application and subsequently rendered to visitors. The injected code runs in the browser of every user who views the affected content, allowing attackers to steal session cookies, hijack accounts, deface the site, or run further malicious actions in the victim’s context.

All installations of the Sanzo theme from skygroup, versions older than 2.4.3, remain vulnerable. The issue applies to any instance where user‑supplied data can be stored and later displayed without proper neutralization.

The CVSS score of 6.5 classifies the vulnerability as medium severity, and the lack of an exploit probability score suggests that actively exploited attacks are not currently documented. It is not listed in the CISA KEV catalog. The vulnerability is a stored XSS; an attacker must first submit malicious input that the theme stores (for example in a post, comment, or theme option) and thereafter any user who loads that content will be exposed. This requires no elevated privileges and can be performed from outside the site, making it relatively easy to exploit with normal web access.