Improper handling of user input allows malicious scripts to be injected into pages served by the WordPress Organici Library plugin. When a victim accesses a crafted URL, the unfiltered input is reflected back into the browser, enabling an attacker to run arbitrary JavaScript. This can lead to credential theft, session hijacking, and site defacement.

The vulnerability affects the NooTheme Organici Library plugin for WordPress, specifically versions up to and including 2.1.2. Any WordPress site that has installed or is currently running this plugin version is potentially exposed.

With a CVSS score of 7.1 the risk is considered high. The exploit is straightforward: an attacker only needs to host a malicious link that the victim follows, and the vulnerability is client‑side, so no special privileges are required. Although the EPSS score is unknown and the flaw is not listed in the CISA KEV catalog, sites that have not applied the patch remain at a moderate to high risk of exploitation.