The Agrofood WordPress theme fails to neutralise user supplied data when building web pages, creating a reflected cross‑site scripting flaw. An attacker can embed malicious JavaScript into a URL; when a victim opens that link the code runs in the victim’s browser. This client‑side execution can be used to hijack session cookies, deface the site, or perform further attacks on the user’s system.

WordPress sites that use the Agrofood theme with a version older than 1.4.0 are vulnerable. All releases of the theme before 1.4.0 are affected regardless of minor patch level.

The vulnerability has a severity score of 7.1, indicating high risk. The likelihood of exploitation is very low, estimated as an exploit probability less than one percent, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. As a reflected XSS, the attack requires a remote attacker to craft a malicious link and a victim to click or visit it, making it a user‑interaction dependent vector. When successful it can enable session takeover, privacy breaches, or the execution of arbitrary client‑side code.