An unauthenticated cross‑site scripting flaw exists in the Educavo WordPress theme up to version 3.4.2, permitting an attacker to inject JavaScript that will run in the browsers of any user who visits affected pages. The injection can be performed without needing to log in or gain file‑system access, meaning it can affect all visitors to the site. The flaw undermines user confidentiality and integrity by letting malicious scripts run in the user’s context and can also degrade user experience or erode trust in the site. The weakness is reflected in CWE‑79.

Victim sites that use the Keen IT Solutions Educavo theme at version 3.4.2 or earlier are affected. No other products or vendors are listed as impacted in the current advisory.

The vulnerability carries a CVSS score of 7.1, indicating a high risk. The EPSS score is not publicly available, and the issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw through unauthenticated HTTP requests that reach the vulnerable code path; the attack does not require a protected environment or special privileges. Once a script runs in a user’s browser, the attacker can potentially harvest session cookies, impersonate users, or propagate additional payloads. Because the exploit does not need authentication, it poses an immediate threat to all visitors to the site.