The vulnerability is a reflected XSS flaw present in WordPress EduMall theme releases up to and including version 4.5.3. It permits an unauthenticated attacker to embed arbitrary JavaScript into pages that are subsequently sent to a visitor, enabling malicious code execution in the victim’s browser during interaction with the affected site.

WordPress installations that use the ThemeMove EduMall theme version 4.5.3 or earlier are affected. The product is the EduMall theme published by ThemeMove.

The CVSS score of 7.1 indicates a high‑severity risk, while the EPSS score of < 1% reflects a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires the attacker to provide malicious input that is reflected back to the user, usually through a crafted URL or form field that the victim must visit or submit, constituting an unauthenticated reflected XSS attack vector.