The vulnerability is a contributor‑controlled Cross‑Site Scripting flaw in the "Manual – Documentation, Knowledge Base & Education" WordPress theme for versions 7.5.4 and earlier. An attacker with editor or contributor privileges could insert crafted input that is rendered improperly, allowing client‑side script execution. This could lead to defacement, credential theft, or session hijacking, compromising the confidentiality, integrity, and availability of the affected site for all visitors. The weakness is identified as CWE‑79, a classic reflected XSS scenario.

The issue affects installations of the pixelacehq Manual – Documentation, Knowledge Base & Education WordPress Theme up to and including version 7.5.4. Any WordPress website using a vulnerable version of this theme is at risk; newer releases beyond 7.5.4 are assumed to contain the fix.

The CVSS score of 6.5 categorizes the flaw as moderate severity. The EPSS score of less than 1% indicates a very low probability of exploitation as of the latest data, and the vulnerability is not listed in the CISA KEV catalog. However, the exploit is trivial to construct once the attacker gains contributor access, so sites should treat it with caution. The likely attack vector is through legitimate contributor or editor activity where malicious content can be injected without elevated administrator rights.