The WorkScout‑Core plugin contains an Improper Neutralization of Input During Web Page Generation flaw that allows reflected Cross‑Site Scripting. An attacker can embed malicious script code in a crafted URL or user input that is rendered unescaped by the plugin, leading to arbitrary code execution within the victim’s browser. This can compromise user cookies, session data, or allow malicious page modifications.

All instances of the purethemes WorkScout‑Core WordPress plugin with a version of 1.7.06 or earlier are vulnerable, as the issue affects the product from its initial release up to and including 1.7.06.

The CVSS score of 7.1 indicates a moderate to high severity. The EPSS score is below 1%, suggesting that exploitation is not widely observed, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a reflected XSS event triggered when a user opens a specially crafted link containing malicious payloads; thus, exploitation requires the user to navigate to a malicious URL or submit malicious form data.