The Triton Lite WordPress theme (versions up to 1.3) contains a stored cross-site scripting vulnerability (CWE-79) due to insufficient input sanitization and output escaping of the 'url' attribute within its Button shortcode. This allows authenticated users with Contributor-level permissions or higher to inject arbitrary web scripts into pages. These scripts execute in the context of users who visit the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability is network exploitable with low attack complexity and does not require user interaction beyond viewing the injected page.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages, which execute in the browsers of users who view those pages. This can lead to information disclosure or manipulation of user sessions. The vulnerability does not impact availability and has limited confidentiality and integrity impact as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the vulnerable Button shortcode if feasible. Monitor for updates from the theme vendor or WordPress security channels.