The7 WordPress theme versions up to 12.6.0 contain a stored XSS vulnerability due to improper neutralization of input during web page generation (CWE-79). The theme's JavaScript reads user-controlled 'title' and 'data-dt-img-description' attributes via jQuery.attr(), concatenates them into HTML strings, and inserts them into the DOM using jQuery.html() without proper escaping. This allows authenticated attackers with Contributor or higher privileges to inject arbitrary scripts that execute in the context of users viewing the injected pages. The vulnerability is network exploitable with low attack complexity and no user interaction required beyond viewing the page.

Successful exploitation allows an authenticated user with Contributor-level access or higher to inject persistent malicious scripts into pages generated by the theme. These scripts execute in the browsers of users who visit the affected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not impact availability and requires some privileges to exploit. No known active exploits have been reported.

No official patch or vendor advisory is currently available for this vulnerability. Users should monitor the Dream-Theme vendor channels for updates and apply any forthcoming patches promptly. Until a fix is released, consider restricting Contributor-level access and above to trusted users only. Review and sanitize user input where possible to mitigate injection risks. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.