The vulnerability is a reflected Cross‑Site Scripting flaw that results from improper neutralization of user input when generating HTML. An attacker can embed malicious scripts into a crafted URL that, when clicked by a victim browsing a WordPress site that uses the vulnerable WorkScout‑Core plugin, will execute in the victim’s browser. This can lead to session hijacking, credential theft, or defacement of the site from the victim’s context. The weakness is formally identified as CWE‑79.

The flaw affects the purethemes WorkScout‑Core WordPress plugin in all releases prior to version 1.7.06. Any WordPress site that has the plugin installed below this version is exposed.

The CVSS score of 7.1 indicates a high severity for a reflected XSS, while the EPSS score of less than 1 % suggests that automated exploitation of this flaw is currently rare, and it is not a known Exploited Vulnerability per CISA’s KEV catalog. Attackers would need to lure a legitimate user to a crafted URL that triggers the unsanitized input, imposing a low‑to‑moderate difficulty for exploitation.