The The7 WordPress theme contains a stored XSS flaw in the dt_default_button shortcode. The lack of proper input sanitization on the title attribute of the link parameter allows an authenticated user who has Contributor or higher privileges to inject arbitrary JavaScript that is saved in the database. When users subsequently view pages containing the injected content, the malicious code executes in their browsers, potentially compromising user credentials, defacing content, or delivering further malware.

All installations of the Dream‑Theme The7 theme for WordPress up to and including version 14.3.2 are vulnerable. Site owners using these versions should check their theme version and update if necessary.

The vulnerability carries a CVSS score of 6.4, indicating a moderate severity. Its EPSS score is not available and it is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been reported. The attack vector requires the attacker to first log in with at least Contributor privileges, then add or edit a button shortcode that includes a malicious title, after which the stored code is served to any visitor who opens the page.