The flaw is a cross‑site scripting vulnerability that allows a contributor to embed unsanitized JavaScript into content rendered by TheFox theme. A malicious contributor can inject script code that executes in the browsers of visitors to the affected page, potentially hijacking sessions, defacing the site, or delivering phishing content. The weakness is a typical input validation failure, identified as CWE‑79, where the theme does not properly sanitize user‑generated input.

WordPress installations that use tranmautritam's TheFox theme version 3.9.70 or earlier are impacted. Any site that enables a contributor role with the ability to post or edit content is susceptible, as the theme renders such submissions without adequate sanitization.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to acquire contributor access and submit malicious content, after which the injected script runs in the context of any site visitor. Because the condition is the presence of a contributor role, sites without such a role or that filter content prior to rendering are not vulnerable.