The vulnerability is an improper neutralization of input during web page generation that permits reflected cross‑site scripting. An attacker can supply malicious JavaScript that is echoed back in the page’s HTML, allowing execution in the victim’s browser. This can lead to session hijacking, credential theft, or malicious site manipulation for unsuspecting users browsing the affected WordPress site.

QantumThemes Kentha WordPress theme versions up to and including 4.7.2 are affected. Any WordPress installation using the Kentha theme within that version range may be vulnerable if the theme’s input handling has not been patched.

The Exploit Prediction Scoring System indicates a very low exploit probability (<1%), and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, reflected XSS can be invoked through crafted URLs, meaning an active attacker could entice a user to visit a malicious link. The lack of a high CVSS score is offset by the simplicity of the attack vector and the ability to run arbitrary code in the victim’s browser, underscoring the importance of a timely patch.