Unauthenticated Cross‑Site Scripting is found in the WordPress Pin WP theme versions 7.0 and below. The flaw allows an attacker to deliver arbitrary JavaScript to any visitor by crafting a request that is reflected back into the page. If an attacker is able to deliver a malicious payload, they can steal session cookies, deface the site, or redirect users to phishing pages. The weakness is a classic example of record‑type input validation failure, cataloged as CWE‑79.

The vulnerability affects sites that use the An‑Themes Pin WP theme version 7.0 or earlier. Any WordPress installation employing that theme and not updated to a later release is exposed.

The CVSS score of 7.1 indicates a moderate to high severity. EPSS data is not available, but the fact that the flaw is unauthenticated and delivered via reflected input means it is easily exploitable by anyone who can visit a crafted URL. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no publicly confirmed exploits yet. Attackers can achieve it simply by directing victims to a malicious link; no additional preconditions are required beyond web access to the site.