Unauthenticated Cross Site Scripting in the WordPress Uncode theme versions up to 2.12.7 allows an attacker to inject malicious scripts that run in the victim’s browser. The issue arises because the theme does not properly validate or escape content that is rendered, enabling reflected or stored script execution. An exploiter can deface the site, hijack user sessions, or perform other client‑side attacks without needing any credentials, as the vulnerability can be triggered from a public URL.

This flaw affects installations of the Uncode WordPress theme version 2.12.7 or earlier. Sites that have not upgraded to at least version 2.12.8 remain susceptible.

The CVSS score of 7.1 indicates high severity and the lack of an EPSS score suggests current tool data on exploitation frequency is unavailable. The vulnerability is not listed in the CISA KEV catalog. Because the XSS can be activated remotely without authentication and can impact any page visitor, the risk is significant. The attack vector is inferred to be a remote web‑based injection via a malicious URL or manipulated content within the Uncode theme files.