The yootheme WordPress theme prior to version 5.0.35 contains a stored XSS vulnerability (CWE-79) due to insufficient sanitization of certain HTML attributes allowed by wp_kses_post(). This flaw enables users with Author privileges to embed malicious markup that executes in the browsers of users viewing the compromised content. The vulnerability arises because the theme's bundled front-end framework treats these attributes as executable markup, bypassing intended sanitization controls.

An attacker with Author role privileges can perform stored XSS attacks that execute arbitrary scripts in the browsers of users who view the affected posts. This can lead to session hijacking, defacement, or other malicious actions executed in the context of the victim's browser session. The vulnerability affects the confidentiality and integrity of user interactions with the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 5.0.35, updating to version 5.0.35 or later is recommended once a fix is officially released. Until then, restrict Author role permissions and monitor for suspicious activity related to content submissions.