The vulnerability involves improper neutralization of input, resulting in cross‑site scripting that allows an attacker to inject malicious scripts into a page viewed by users. These scripts can be executed in the victim’s browser, potentially leading to session hijacking, credential theft, or defacement of the site. The weakness is a client‑side injection flaw.

The defect affects WordPress installations that use the ThemeGoods Musico theme with version numbers preceding 3.4.5. Versions 3.4.5 and later contain the fix.

This flaw carries a CVSS score of 7.1, indicating a high severity with potential for serious impact on confidentiality and integrity. The EPSS score of less than 1% suggests a low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is reflected XSS, requiring an attacker to craft a malicious link or payload that a victim opens. If successfully exploited, the attacker could run arbitrary scripts in the victim’s browser, enabling session hijack or data theft, although the vulnerability is not a remote code execution.