Improper neutralization of script‑related HTML tags in the Armania theme enables attackers to inject malicious code via shortcodes. This basic XSS flaw allows the execution of arbitrary JavaScript, which could lead to cross‑site scripting attacks against site visitors, session hijacking, content defacement, or credential theft. The weakness is classified as CWE‑80.

The vulnerability affects all installations of the Kutethemes Armania WordPress theme up to, and including, version 1.4.8. No specific sub‑components are mentioned, so any site running a vulnerable theme version is at risk.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of less than 1 % suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would likely involve an attacker crafting a malicious shortcode or input that the theme fails to sanitize, which could be delivered through the content editor or a user‑submitted post, giving the attacker the ability to run JavaScript in the context of site users.