The Astra theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `ast-page-background-meta` and `ast-content-background-meta` post meta fields in all versions up to, including, 4.12.3. This due insufficient input sanitization on registration missing output escaping `astra_get_responsive_background_obj()` function four CSS-context sub-properties (`background-color`, `background-image`, `overlay-color`, `overlay-gradient`). makes it possible authenticated attackers, with Contributor-level access above, inject arbitrary web scripts pages that will execute whenever a user accesses an injected page.