The vulnerability is a classic cross‑site scripting flaw that permits a malicious actor to inject arbitrary JavaScript into pages viewed by site subscribers. The injected script runs in the victim’s browser context, enabling session hijacking, credential theft, defacement, or other client‑side attacks. The weakness is classified as CWE‑79, reflecting unsanitized user input rendered as executable code.

CridioStudio’s ListingPro WordPress theme versions up to and including 2.9.11 are affected. Hosts deploying any of these releases may expose subscribers and site visitors to the XSS vector.

The CVSS score of 6.5 classifies the flaw as medium severity. EPSS data is unavailable, and it does not appear in the CISA KEV catalog. Based on the description, it is inferred that the attack vector involves an attacker submitting malicious script payloads through subscriber‑supplied content fields; the ability to create or modify subscriber data provides the necessary input location. Successful exploitation does not grant remote code execution on the server but can still facilitate client‑side compromise and credential theft.