An unauthenticated reflected Cross Site Scripting flaw exists in the TechOne WordPress theme for versions up to and including 3.0.3. The vulnerability, classified as CWE‑79, allows an attacker to embed malicious scripts within user input that is subsequently rendered by the theme. When a victim visits a crafted URL or interacts with a susceptible form, the payload can execute in the victim’s browser, potentially leading to credential theft, session hijacking, and defacement of the site.

WordPress sites using the TechOne theme from kutethemes (TechOne) that are running version 3.0.3 or earlier are affected. All instances of this theme on any web server that have not been upgraded beyond 3.0.3 are vulnerable.

The CVSS score of 7.1 indicates a high risk severity; the vulnerability requires no authentication and leverages a reflected XSS vector, meaning exploitation is straightforward and does not require advanced privileges. The EPSS score is not available, but the issue is not listed in CISA’s KEV, suggesting currently no widespread exploitation but the potential for abuse remains due to the broad use of WordPress themes. Attackers can simply craft a malicious link and entice a user to click it, making this vulnerability highly actionable.