The GT3themes SOHO - Photography WordPress Theme (versions <= 3.0.3) contains a DOM-based Cross-site Scripting vulnerability due to improper input neutralization during web page generation. This vulnerability allows attackers to inject and execute arbitrary scripts in the victim's browser, potentially leading to data theft, session hijacking, or other malicious activities. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected website's users, potentially leading to information disclosure, session hijacking, or other client-side impacts. The vulnerability affects confidentiality, integrity, and availability to a low degree but is significant enough to warrant attention due to the ease of exploitation and scope change.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or replacing the affected theme to mitigate risk. Monitoring for updates from GT3themes or the WordPress theme repository is recommended to apply any forthcoming patches promptly.