RadiusTheme Metro theme (versions up to 2.13) contains a DOM‑based Cross‑Site Scripting flaw caused by an improper neutralization of user input before it is displayed in a web page. An attacker can inject malicious JavaScript that will execute in the context of the victim’s browser, allowing the attacker to read or modify sensitive information, hijack user sessions, or deface the site.

The vulnerability affects the WordPress Metro theme from vendor RadiusTheme, specifically all releases numbered 2.13 and earlier, including earlier undocumented releases. Any instance of the theme without an upgrade to a later version is susceptible.

The vulnerability is rated with a CVSS score of 7.1, indicating a medium‑to‑high impact if exploited. The EPSS score is reported as less than 1%, suggesting that the chance of real‑world exploitation is presently very low. The CVE is not listed in CISA’s KEV catalog. Exploitation is likely to occur via crafted URLs or form inputs that the theme processes; the attacker would need only a user clicking a link or visiting a malicious page to trigger the payload. As the flaw is DOM‑based, it does not require any server‑side components to be compromised, which limits prerequisites but also means the vector is web‑based and only requires user interaction.