The vulnerability is a reflected cross‑site scripting flaw in the KuteShop WordPress theme that allows an attacker to inject and execute arbitrary JavaScript in the browsers of any visitor to a vulnerable site. This can lead to session hijacking, cookie theft, phishing, or defacement of the site content. The weakness is described by CWE‑79.

WordPress sites that use the KuteShop theme version 4.2.9 or earlier are affected. No specific installation or configuration details are supplied beyond the version constraint.

The CVSS score of 7.1 indicates a high severity rating. EPSS is not available, so the likelihood of exploitation cannot be quantified precisely, but the absence of an authentication requirement and the reliance on a simple reflected payload make the attack relatively easy to launch. The vulnerability is not listed in the CISA KEV catalog, yet it remains a credible threat to any site running a vulnerable version of the theme. Adopting typical mitigations such as a strict content security policy or proper input validation could reduce the risk until a patch is applied.