The Total WordPress theme until version 2.2.1 fails to escape output when rendering the post title inside an HTML image alt attribute in the home page blog section. This omission gives authenticated users with contributor or higher privileges the ability to inject malicious JavaScript that runs automatically when a visitor loads a page showing that post. The injected script can hijack the victim's session, deface the site, or perform other client‑side attacks. The vulnerability is a classic stored cross‑site scripting flaw (CWE‑79).

WordPress installations using the Total theme version 2.2.1 or earlier are affected. Only users who have contributed or higher privileges can create or edit posts; a post must be published and display a featured image in the Home Page blog section for the flaw to be exploitable.

The CVSS score of 5.4 indicates a medium severity. The exploit requires authenticated access, so the attack will be limited to sites where an attacker can acquire contributor‑level credentials. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the attacker needs to own or edit a post, the risk is bounded but still significant, especially on sites with many contributors or lax role review. Attackers could target popular blogs to compromise their visitors.