CWE‑79 Cross Site Scripting occurs when a contributor can submit content that the theme renders without proper sanitization, allowing arbitrary JavaScript to be embedded. The likely attack vector is the submission of malicious user‑generated content by a user with contributor privileges, which is inferred from the description as the only mechanism for injection. When a site visitor loads the affected page, the injected script executes in the context of the visitor’s browser, which can alter displayed content, create phishing opportunities, or otherwise disrupt the user experience. The flaw resides in the theme’s handling of user‑generated content rather than in core WordPress functionality.

WordPress sites that use the TheFox theme from vendor tranmautritam with version 3.9.70 or earlier are impacted. Any site that employs these theme versions and permits contributor uploads is at risk.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity. Its EPSS score of less than 1% reflects a very low probability of exploitation, and the flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers would exploit the flaw by acting as contributors to embed malicious scripts, though a successful attack requires the presence of a contributor role and the ability to submit content.