Key detail from vendor description: The Astra theme includes a stored cross‑site scripting flaw in the `ast-page-background-meta` and `ast-content-background-meta` post meta fields. The flaw arises from insufficient input sanitization during meta registration and from missing output escaping when rendering four CSS‑context sub‑properties -- background-color, background-image, overlay-color, and overlay-gradient. As a result, an attacker who can edit these fields can inject arbitrary JavaScript. The injected script executes whenever any visitor loads an affected page, enabling actions such as session hijacking, defacement, or other malicious behaviors. The weakness is identified as CWE‑79.

All installations of WordPress that use the Astra theme and run any version through and including 4.12.3 are susceptible, as the vulnerability exists in every build up to that point. The description specifically notes that the issue is present in "all versions up to, and including, 4.12.3".

The CVSS score of 6.4 classifies this issue as medium severity. An EPSS score of less than 1% suggests a low likelihood of exploitation in the wild; it is not listed in the CISA KEV catalog. Attackers must first be authenticated with Contributor-level privileges or higher, a role commonly available on multi‑user WordPress sites. Because the vulnerability is stored in post meta, the impact once a payload is injected affects all subsequent users who view the page, leading to potentially wide‑scale compromise of confidentiality, integrity, and availability for site visitors.