Improper neutralization of user input in the Pond theme causes reflected XSS, allowing an attacker to embed malicious script code that is executed within a victim’s browser when an untrusted value is reflected back in the page. This can lead to cookie theft, session hijacking, defacement, or other client‑side attacks. The weakness is a classic input validation flaw covered by CWE‑79.

The Pond theme from any version up to and including 2.6.1 is affected. The vulnerability status of newer versions is unknown. Installations using a vulnerable version are at risk.

The CVSS score of 7.1 indicates a medium to high risk level, while the EPSS score is not available, meaning the overall exploitation probability is unclear. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an externally supplied input such as a crafted URL or form entry that is reflected back to the user. No authentication or elevation of privileges is required, so the attack is feasible against any visitor to the site.