The vulnerability is an Improper Neutralization of Input During Web Page Generation (Cross‑Site Scripting) in the NooTheme Yogi – Health Beauty & Yoga WordPress theme. Reflected XSS is possible in versions up to and including 2.9.2 when untrusted input is not properly sanitized before being included in a page. The flaw allows the execution of arbitrary scripts in the context of a visitor’s browser, potentially exposing user data or affecting the rendered page.

The NooTheme Yogi – Health Beauty & Yoga WordPress theme is affected in all versions up to and including 2.9.2. Hosts that use this theme on a WordPress installation are at risk.

The CVSS score of 7.1 indicates a high severity, while the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a reflected XSS that exploits untrusted input without requiring authentication. An attacker would typically need to convince a victim to visit a crafted URL, leading to script execution in the victim’s browser. The low exploitation probability suggests limited real-world exploitation but the impact remains significant.