The vulnerability is an improper neutralization of input during web page generation (CWE‑79). It allows an attacker to inject arbitrary JavaScript that is reflected back to the victim’s browser when a crafted URL or form is processed. This can lead to session hijacking, credential theft, phishing, or defacement of the site while keeping the user unaware that the content is malicious.

The issue appears in the Martfury – WooCommerce Marketplace WordPress theme distributed by drfuri. All releases from the earliest available version up to and including 3.3.9 are affected. Any site using one of these theme versions without an upgrade to a newer release is vulnerable.

The CVSS score of 7.1 indicates a moderate‑to‑high severity reflected XSS that can be triggered remotely via a crafted web request. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Because it is reflected, the attacker only requires the victim to visit a maliciously crafted URL; no authentication or elevated privileges are needed for exploitation. The risk is significant for publicly exposed e‑commerce sites that may rely on user‑generated content within the theme.