Cross-site scripting (XSS) is a vulnerability found in WordPress before version 4.7.1. It allows malicious attackers to inject malicious code such as web scripts or HTML into websites through a crafted directory name of a theme. This vulnerability is related to the theme-name fallback functionality in the wp-includes/class-wp-theme.php and the wp-admin/includes/class-theme-installer-skin.php files.