The skygroup Yobazar theme contains an Improper Neutralization of Input During Web Page Generation flaw that lets an attacker inject script content through unescaped user input. When a victim visits a page built by the theme, the malicious code executes in the victim’s browser, potentially allowing session hijacking, credential theft, or page defacement. The weakness is categorized as CWE‑79 and directly threatens the confidentiality and integrity of site users.

WordPress installations that utilize the Yobazar theme with a version prior to 1.6.7 are vulnerable. Any site that has not updated to the 1.6.7 release or later remains at risk, regardless of the WordPress core version.

The CVSS base score of 7.1 signals a high‑severity vulnerability. EPSS data is not provided, and the flaw is not listed in the CISA KEV catalogue. The likely attack path is inferred to involve a crafted URL or form containing malicious JavaScript that a victim clicks or submits, making it a user‑interaction‑dependent attack. Given the ease of creating such a link, the potential for exploitation in malicious campaigns remains significant.