A DOM-based cross‑site scripting vulnerability exists in the Soledad theme by PenciDesign; the theme does not properly neutralize user input that is rendered in the web page, so an attacker can inject JavaScript that executes in the victim’s browser. When exploited, the attacker can steal session cookies, deface content, or hijack a user’s session. The flaw is triggered by data that passes through the theme’s generation process and is reflected in the browser.

All installations of the Soledad theme up to and including version 8.7.2 are affected. The product is the PenciDesign Soledad WordPress theme, and any WordPress site running a vulnerable version remains at risk.

The CVSS score of 6.5 indicates a moderate severity vulnerability, and the EPSS score of less than 1% suggests that exploitation is currently unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to visit a page where the theme fails to sanitize input, so the risk is elevated for sites that expose user‑generated content or public widgets powered by the theme.