The Uminex theme for WordPress contains a Basic XSS flaw caused by inadequate escaping of script‑related HTML tags. This weakness allows an attacker to embed malicious scripts or shortcodes that execute when the content is rendered, leading to code injection into the site’s front‑end or administrative pages. The consequence can include credential theft, page defacement, or further exploitation of the server.

WordPress installations that use the kutethemes Uminex theme version 1.0.9 or older are impacted. Versions newer than 1.0.9 are not known to contain this vulnerability.

The CVSS score of 5.3 signals moderate severity, while the EPSS score of less than 1% indicates a low likelihood of real‑world exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that an attacker would exploit this flaw by creating or editing a WordPress post or page that contains a malicious shortcode, causing the script to run in the context of visitors or site administrators.