The7 — Website and eCommerce Builder for WordPress theme versions up to 12.9.1 contain a stored cross-site scripting vulnerability (CWE-79) via the 'the7_fancy_title_css' parameter. This parameter is not properly sanitized or escaped, allowing authenticated users with Contributor or higher privileges to inject arbitrary JavaScript code. When other users access pages containing the injected code, the script executes in their browsers, potentially leading to session hijacking or other client-side attacks. The vulnerability is network exploitable with low attack complexity and no user interaction required beyond authentication. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, reflecting partial confidentiality and integrity impact but no availability impact.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable parameter. This can lead to client-side code execution in the context of other users viewing the affected pages, potentially compromising user sessions or performing unauthorized actions on behalf of users. The impact affects confidentiality and integrity but does not affect system availability. There are no known active exploits in the wild at this time.

No official patch or remediation has been confirmed for this vulnerability as of the published date. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the vulnerable parameter if possible. Monitor vendor communications for updates on patches or official mitigations.