The vulnerability is an unauthenticated Cross Site Scripting flaw (CWE-79) in the NanoMag WordPress theme versions 1.8 and below. It allows an attacker to inject and execute arbitrary JavaScript within the context of the site, potentially impacting users by hijacking sessions, defacing content, or enabling other malicious actions.

The affected product is the Jellywp NanoMag WordPress theme, versions 1.8 and earlier. Sites using these releases are vulnerable until the theme is upgraded to a patched version.

The CVSS score of 7.1 classifies the flaw as high severity. The EPSS score is not available, so the exploitation probability cannot be quantified. The vulnerability is not listed in CISA's KEV catalog. Because the flaw is unauthenticated and does not require special privileges or network access, an attacker can trigger it by loading a crafted URL or submitting malicious input through the theme's interfaces from any browser.