An improper neutralization of input during web page generation (CWE‑79) allows attackers to inject and execute arbitrary client‑side scripts. When a victim loads a URL or interacts with a page that reflects unsanitized user input, the attacker’s script can run in the victim’s browser, enabling information theft, session hijacking, content defacement, or the delivery of further malware. The vulnerability is limited to reflected XSS and does not provide remote code execution or server‑side compromise.

The flaw exists in the WordPress plugin NasaTheme Nasa Core, specifically in all releases from the first available version through 6.4.4. Any WordPress site that has installed this plugin version is susceptible to the vulnerability.

With a CVSS score of 7.1 the issue is classified as high severity. The EPSS score of less than 1 % suggests an extremely low probability that the flaw will be actively exploited at this time, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely via a crafted link or input without user authentication, targeting visitors who load the affected page. Attackers would need to send or embed the malicious payload into a URL or form field that the plugin subsequently renders without proper sanitization.