EIP-2026-114303

The provided text describes a cross-site scripting (XSS) vulnerability in the Ambience theme for WordPress, where user-supplied input is not properly sanitized. An attacker can exploit this by injecting arbitrary script code via the 'src' parameter in the thumb.php file.