The vulnerability is a reflected cross‑site scripting flaw that allows an attacker to inject malicious scripts into pages rendered by the theme. It is classified as CWE‑79 and can enable a visitor to execute arbitrary JavaScript in their browser, potentially hijacking sessions, defacing content, or delivering malware. The flaw stems from improper sanitization of user‑supplied data before it is incorporated into the HTML response.

The issue affects the JanStudio Claue – Clean, Minimal Elementor WooCommerce Theme for WordPress, specifically all releases up through and including version 2.2.7. Any site that has deployed this theme without subsequent patching is potentially exposed.

The CVSS score of 7.1 reflects a high severity exploitability and impact. The EPSS score of less than 1% indicates that, while the threat exists, the likelihood of widespread exploitation is currently low. The vulnerability is not listed in CISA’s KEV catalog. It is typically triggered by a crafted request to a page that incorporates user input without proper escaping; an attacker would need to lure a victim to a maliciously constructed URL or form submission. Such an att&ck would require user interaction but could be effective against any browsing user of the affected site.