The vulnerability is a classic Reflected Cross‑Site Scripting flaw caused by improper sanitization of user input before rendering it in the output page, as defined by CWE‑79. An attacker can inject malicious JavaScript via a crafted URL or form field that is echoed back to the visitor. If the victim is an administrator or a privileged user with an active session, the payload could steal cookies or perform actions on behalf of that user, leading to session hijacking or defacement of the site. The flaw does not grant arbitrary code execution but can compromise the confidentiality and integrity of the site’s content and user data.

The Grand News WordPress theme released by ThemeGoods, version 3.4.3 and all earlier releases, is affected. The theme is commonly deployed on magazine, newspaper, and news‑related WordPress sites.

The CVSS v3 score of 7.1 places it in the High severity band, yet the EPSS score is less than 1 %, indicating a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a Reflected XSS via an HTTP request that contains unsanitized input, most likely a query parameter or form field. Exploitation requires only that a user click a malicious link or submit a crafted form, after which the script executes within the victim’s browser context.