Unauthenticated cross‑site scripting exists in the Armania theme for WordPress versions 1.4.8 and earlier. By injecting malicious JavaScript through specially crafted URLs or form inputs, an attacker can cause the victim’s browser to execute arbitrary code. This client‑side execution can lead to session hijacking, cookie theft, defacement, or other malicious actions performed in the context of the logged‑in user.

WordPress websites that use the kutethemes Armania theme 1.4.8 or older. The vulnerability affects any installation of this theme regardless of site configuration because it accepts unsanitized input from user‑supplied query parameters.

The CVSS score of 7.1 places the flaw in the medium‑high severity range. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The flaw can be exploited over the web without authentication by sending a crafted link to a victim; the victim’s browser processes the reflected payload and executes the injected script.