This vulnerability (CVE-2026-65511) is an instance of CWE-79, improper neutralization of input during web page generation, resulting in unauthenticated Cross-Site Scripting (XSS) in the Manual WordPress theme by pixelacehq. It affects versions up to and including 7.5.4. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires low attack complexity, no privileges, but requires user interaction, and results in a scope change with low impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary scripts in the context of the affected website. This can lead to partial disclosure of sensitive information, modification of website content, and potential disruption of service. The CVSS score of 7.1 reflects a high impact with confidentiality, integrity, and availability impacts rated as low but scope changed, indicating the vulnerability crosses security boundaries.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing web application firewall (WAF) rules to detect and block XSS payloads targeting this theme. Avoid using affected versions in production environments if possible.