The flaw arises from improper neutralization of user input during web page generation, allowing reflected XSS. An attacker can inject arbitrary JavaScript that runs in the browser of any visitor to the affected page. This can lead to session hijacking, credential theft, defacement, or redirect into malicious sites. The weakness is categorized as CWE‑79.

The vulnerability exists in the Houzez theme provided by Houzez.co, affecting all releases up to and including version 4.4.0. Any WordPress installation using this theme is potentially impacted, regardless of other plugins or PHP version.

The CVSS score of 7.1 indicates a medium to high severity. The EPSS score of 0.00146 (less than 1%) shows a very low exploitation probability, and the vulnerability is not listed in CISA KEV. Attackers can target the site by sending a crafted URL or form containing a malicious payload that is reflected back to the user. Successful exploitation requires the victim to load the page in a browser; therefore, the threat is primarily remote but requires user interaction.