This vulnerability is a Reflected Cross‑Site Scripting flaw caused by improper neutralization of input during web page generation, as identified under CWE‑79. When an attacker supplies a crafted query string or form value that is not properly sanitized, the input is reflected directly into the page’s HTML output, allowing the attacker to inject and execute arbitrary JavaScript in the context of users who view the affected page. Such injected code can steal cookies, session identifiers, or perform phishing attacks on visitors.

The flaw exists in the Bricks Builder WordPress theme for all releases from the earliest identifiers through versions 1.9.2 up to 2.2. Administrators running any of these versions of Bricks Builder are affected.

The vulnerability carries a CVSS score of 7.1, indicating high severity. EPSS data is not available, so the current exploitation probability cannot be quantified, but the lack of presence in KEV suggests no known large‑scale exploits yet. Attackers could trigger the vulnerability with a simple crafted URL or form input visited by a user; local privilege is not required. Consequently, the risk is moderate‑high for sites with publicly accessible pages that may echo user input.