The vulnerability in the Kids Planet WordPress theme allows an attacker to inject malicious scripts into a page that is returned to the victim. The flaw stems from improper input neutralization and can lead to compromise of user sessions, data theft, or defacement of the site by executing arbitrary JavaScript in a victim’s browser. The weakness is a classic cross‑site scripting flaw.

The issue affects all WordPress sites that use the Kids Planet theme from its earliest release up to and including version 2.2.14.2. No other plugins or themes are mentioned as vulnerable.

The CVSS score is 7.1, indicating a high risk. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog. Likely attack vectors include delivering a crafted URL that a user opens, triggering the reflected XSS. No specific authentication or privilege conditions are indicated, so the threat relies on the ability to persuade a user to visit a malicious link.