An unauthenticated reflected XSS flaw exists in the TieLabs Jannah WordPress theme versions prior to 7.6.8. This flaw results from improper neutralization of input during web page generation, allowing attackers to inject and execute arbitrary JavaScript in the context of any visitor’s browser that loads a page rendered by the vulnerable theme. It is a CWE‑79 vulnerability.

The theme affected is the TieLabs Jannah WordPress theme, specifically any installation using a version earlier than 7.6.8 (including 7.6.5 or older). Users who have not upgraded the theme to 7.6.8 or later remain at risk.

The CVSS score of 7.1 reflects a high severity rating. The EPSS score is displayed as < 1%, indicating a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog, so exploitation frequency is uncertain. Because the flaw can be triggered without authentication and only requires a visitor to load a page rendered by the vulnerable theme, attackers can embed malicious scripts directly into the page content.