This vulnerability allows an unauthenticated attacker to inject arbitrary scripts into webpages served by the WPLMS theme on WordPress installations. The reflected XSS flaw is triggered through input parameters that are not properly sanitized, leading to potential theft of user sessions, defacement, or delivery of malware. The weakness is reflected in the input and identified as CWE‑79.

Affected by the WPLMS theme provided by VibeThemes, all WordPress sites running version 4.972 or earlier are vulnerable. No other versions are listed as impacted.

With a CVSS score of 7.1, the vulnerability is considered high severity. The EPSS score is 0.00237, indicating a low probability of exploitation in the near term. The flaw is not listed in the CISA KEV catalog. The reflected XSS weakness requires unauthenticated access and relies on reflected input; attackers can trick users into clicking malicious links, leading to script execution in the victim’s browser. This makes the risk significant, especially in environments with high traffic or sensitive data handled via the theme.