The flaw is an Improper Neutralization of Script-Related HTML Tags (Basic XSS, CWE-80) that allows a malicious actor to inject arbitrary HTML or JavaScript through the DukaMarket theme’s shortcode system. Attackers can supply a custom shortcode that executes scripts in the visitor’s browser, potentially leading to data theft, defacement, or other browser‑side compromises.

WordPress sites using the kutethemes DukaMarket theme of version 1.3.0 or earlier are affected. Any installation that has not upgraded past these releases remains vulnerable.

With a CVSS score of 5.3 the vulnerability is of moderate severity, but an EPSS score of less than 1% indicates a very low likelihood of real‑world exploitation. The flaw is not listed in CISA’s KEV catalog. Attackers could exploit the vulnerability remotely by submitting a crafted shortcode if such a capability is available on the site; the attack vector is therefore inferred to be remote via the shortcode interface.