A contributor‑based cross site scripting (XSS) flaw exists in the Neve PRO WordPress theme (versions up to and including 3.1.2). The vulnerability enables an attacker to inject malicious JavaScript into the theme’s output, which will execute in the browsers of visitors who view the affected content. This can lead to session hijacking, credential theft, defacement, or the delivery of additional malware.

The affected product is the Neve PRO theme from Themeisle, with all versions up to and including 3.1.2 impacted. Any hosting environment running those versions is susceptible.

The CVSS v3 score of 6.5 indicates a moderate severity risk. EPSS information is not provided, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely through manipulated content submitted by contributors or users interacting with the theme’s features, which is then rendered without proper sanitization.