The vulnerability is an improper neutralization of input during web page generation, allowing attackers to inject scripts that are reflected back to the user. When an attacker crafts a URL or form input containing malicious JavaScript, the theme fails to escape the content, causing the browser to execute the script in the context of the site. This can compromise the confidentiality and integrity of user data, as well as the availability of the web application if the injected script performs disruptive actions. The weakness is classified as CWE‑79 with a CVSS score of 7.1, indicating high severity.

Any site using the Bracketweb Zeinet WordPress theme version 1.0.0 or earlier is affected. The issue originates in the theme itself, not in the underlying WordPress core, so all installations that have not upgraded past this release are vulnerable.

The CVSS score of 7.1 reflects a significant risk. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, which suggests no currently known large-scale exploitation, but that does not change the inherent risk. Attackers can exploit this via a crafted URL or form input that includes JavaScript. The vulnerability is likely accessible to any authenticated or unauthenticated user who can inject data into the theme’s input fields, and the reflected nature makes it easy to demonstrate in a browser console.