A content injection flaw exists in the Astra WordPress Theme through version 4.13.12 and earlier, allowing malicious actors to insert arbitrary content into a site. The weakness is identified as CWE‑80, which typically permits the injection of data that is subsequently rendered on web pages. The CVE description notes that this vulnerability is a "Shop manager Content Injection" issue, implying that an attacker could modify shop‑related pages or other content delivered by the theme. The short “Content Injection” label and a CVSS score of 2.7 suggest that the impact is relatively modest, with no potential to compromise the underlying operating system or obtain remote code execution.

Any installation of the Astra WordPress Theme produced by Brainstorm Force with a version of 4.13.12 or earlier is affected. Administrators should verify the theme version on their sites and create a backup before making changes.

The CVSS value of 2.7 places this vulnerability in the low‑severity range, and the EPSS score is not available, indicating no publicly known high‑frequency exploit activity. At the time of this assessment, the vulnerability is not listed in the CISA KEV catalog. Based on the nature of the flaw, exploitation would likely require the ability to influence content submitted to the WordPress back‑end, such as by abusing theme‑specific settings or user‑generated content mechanisms. Because the CVSS base score is low, the required privilege level is probably site‑admin or higher, and the exploit would not provide broader system compromise.