Unauthenticated Cross Site Scripting is present in WordPress Jobify Theme versions up to 4.3.2, allowing an attacker to inject malicious scripts into web pages rendered by the theme. The flaw is a classic Reflected XSS vulnerability (CWE-79) that can compromise user data, execute arbitrary code in a victim’s browser, and lead to session hijacking or defacement.

The vulnerability affects Astoundify’s Jobify WordPress theme for all installations running version 4.3.2 or earlier. Any site that relies on this theme without upgrading to 4.3.3 or later is potentially exposed.

The CVSS score of 7.1 indicates moderate to high severity, and because the flaw is unauthenticated, any external actor can trigger it by sending malicious input. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An adversary can exploit the weakness by visiting a crafted URL or submitting malicious form data to the theme’s front‑end components, causing the injected script to run in the browser context of unsuspecting visitors.