The Education Center WordPress theme contains an improper neutralization of input that causes reflected cross‑site scripting. When unescaped user data is included in the generated HTML, it can be reflected back to the client’s browser, enabling an attacker to inject malicious scripts that execute in the victim’s context.

The vulnerable product is the WordPress Education Center theme from ThemeREX, versions 3.6.12 and earlier. Any WordPress site that implements these theme versions, regardless of the core WordPress version, is susceptible to the flaw.

The CVSS base score of 7.1 denotes high severity. No EPSS score is currently available, so the exploitation probability remains unknown. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the issue by visiting a specially crafted URL or inserting such a URL into a link; no authentication or privileged access is required, making the attack broadly attainable.