Improper neutralization of script‑related HTML tags in the Uminex theme allows an attacker to inject arbitrary code through shortcodes. The injected code can execute JavaScript in the context of visitors to the site, potentially leading to information disclosure, session hijacking, or further exploitation of the victim’s browser. The vulnerability is a form of basic XSS (CWE‑80) that can be used for malicious script execution and may also enable broader code injection depending on the theme’s handling of the input.

The Uminex WordPress theme from KuteThemes, version 1.0.9 and all earlier releases, is affected. Any installation that has not upgraded beyond 1.0.9 is vulnerable.

The CVSS details are not provided, but the exploit is likely to be feasible from the web as the vulnerability arises when an attacker can create or modify content that includes a shortcode. No authentication requirement is mentioned, so the risk applies to all content editors or, if a user can insert shortcodes, to any site visitor. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not presently exploited in the wild, but the potential for widespread impact remains because WordPress themes are commonly used.