This vulnerability in creativethemeshq Blocksy theme (versions <= 2.0.19) involves improper neutralization of input during web page generation, leading to a cross-site scripting (XSS) flaw. The CVSS 3.1 score is 6.5 (medium), with attack vector network, low attack complexity, requiring low privileges and user interaction, and impacts on confidentiality, integrity, and availability. The vulnerability allows an attacker to inject malicious scripts that could execute in the context of other users, potentially leading to data disclosure or manipulation. No patch or vendor advisory information is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to partial disclosure of confidential information, modification of data, or disruption of service. The impact is limited by the requirement for user interaction and low privileges. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted input and consider applying any available temporary mitigations recommended by the vendor or security community. Monitor official sources for updates.