The vulnerability is an unauthenticated reflected XSS flaw found in the Biolife theme for WordPress. Attackers can inject arbitrary JavaScript that is returned in HTTP responses, allowing session hijacking, cookie theft, defacement, or malicious script execution in the browsers of site visitors. This weakness is classified as CWE-79 and exemplifies a failure in input validation where unfiltered user data is included in output.

WordPress sites that have installed the Biolife theme from kutethemes and are running version 3.2.3 or older. Any environment using the affected theme is susceptible without an update.

With a CVSS score of 7.1 the flaw is considered high impact. The EPSS score is not available, indicating that exploitation statistics are not publicly reported, yet the lack of authentication and web‑based attack surface makes the risk non‑negligible. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers can reach the vulnerable code by loading any page that renders the Biolife theme and supplying malicious input via URL parameters or form fields; no privileged access is required.