The DukaMarket theme up to version 1.3.0 contains an improper neutralization of script‑related tags. The flaw allows attackers to inject malicious code through the shortcode mechanism. If executed, the injected payload can run arbitrary JavaScript or WordPress shortcodes, potentially giving attackers remote code execution privileges within the affected site.

All WordPress sites that have installed the Kutethemes DukaMarket theme version 1.3.0 or earlier are vulnerable. Both modern and legacy installations are affected until the theme is upgraded or removed.

The vulnerability exploits a basic XSS in the theme’s shortcode processing, making it accessible via any content that allows shortcode insertion. Attackers likely need site author or administrator privileges to insert vulnerable content. While the CVSS score is not listed in the data, the nature of arbitrary code execution suggests high severity. EPSS is unavailable, and the flaw is not yet catalogued by CISA KEV, but the potential impact warrants immediate attention.