The theme contains JavaScript (assets/js/onLoad.js) which iterates through .section-tabs a and puts every href value it finds into jQuery(). jQuery() doesn’t just search for elements which match a selector (i.e. jQuery('.section-tabs')), it also creates elements (i.e. jQuery('<div>')).

$('.section-tabs').simpleSlideTop();

// ...

$.fn.simpleSlideTop = function(opts) {

    // ...

    contentID = $(this).attr('href');

    $(contentID).hide();

An attacker without the unfiltered_html capability would be able to inject arbitrary HTML as if they had the unfiltered_html capability. With the ability to inject arbitrary HTML, the attacker is able add JavaScript which causes a logged-in administrator user to do almost anything – including creating new user accounts, deleting posts, and more.

Current state: Fixed