TheCartPress Boot Store Theme Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in TheCartPress Boot Store theme, version 1.6.4, for WordPress. The issue arises in the header.php file, where user input is not properly sanitized, allowing for the injection of malicious scripts.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, log into a WordPress site using TheCartPress Boot Store theme version 1.6.4. Navigate to the registration page and trigger a registration error. The error message will reflect the injected script, demonstrating the cross-site scripting vulnerability.