Stored Cross-site Scripting (XSS) occurs because the theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This issue allows an attacker who can create or modify menu link titles, via menu administration or permitted content menu settings, to execute malicious scripts in the context of the user's session.