The vulnerability arises from improper neutralization of script-related HTML tags in the Kutethemes Armania WordPress theme, allowing attackers to insert and execute custom code within shortcodes. When the theme processes content containing these shortcodes, the malicious code can run with the privileges of the WordPress installation. This flaw gives a malicious actor the ability to manipulate page content, inject scripts, or potentially run arbitrary PHP code, compromising the confidentiality, integrity, and availability of the site.

All releases of the Kutethemes Armania theme from the first available version through version 1.4.8 are affected. No other vendors or products have been identified as impacted by this vulnerability.

The CVSS score is not provided, but the nature of the flaw indicates a high severity potential. No EPSS score is available and the vulnerability is not listed in the KEV catalog. The likely attack vector is web-based through content submission; an attacker with the ability to add or edit posts or pages can insert a malicious shortcode that the theme will process and execute. Successful exploitation would grant the attacker control over the WordPress site and its data.