The Molla theme fails to neutralize user input when generating web pages, resulting in a reflected cross‑site scripting flaw. An attacker can embed malicious JavaScript that is returned intact to a victim’s browser during a request. Executed in the victim’s context, the code can harvest cookies, manipulate the page, or redirect the user to malicious sites. This weakness falls under the common web input handling defect classification.

WordPress installations that employ the don‑themes Molla theme with a version older than 1.5.19 are impacted. Any site using the theme from its earliest releases up through 1.5.18 contains the unsanitized input logic that enables reflected XSS on pages where the theme reflects request data.

The CVSS score of 7.1 indicates a medium‑to‑high severity level. Exploitation requires only a crafted URL or form payload sent through standard web traffic and does not need privileged access. No EPSS score is listed, and the vulnerability is not catalogued by CISA KEV. Because the attack path is straightforward, sites exposed to malicious links or inputs face a significant risk of client‑side compromise.