The NasaTheme Elessi WordPress theme contains a reflected cross-site scripting vulnerability (CVE-2025-49873) due to improper input neutralization during web page generation. This flaw affects all versions up to 6.3.9 and allows attackers to inject malicious scripts that execute when a user interacts with crafted web content. The vulnerability has a CVSS score of 7.1, reflecting its high severity and potential to impact confidentiality, integrity, and availability. No patch or official remediation guidance is currently provided by the vendor, and no exploits have been observed in the wild.

Successful exploitation of this reflected XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser session. This can lead to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability of user data. However, there are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when interacting with untrusted inputs or links related to the Elessi theme. Monitoring for updates from NasaTheme is recommended to apply patches promptly once available.