A reflected cross‑site scripting vulnerability in the NooTheme Visionary Core plugin allows an attacker to inject and execute malicious scripts in the browser of any user who views a crafted page. The flaw occurs when the plugin fails to properly neutralize user‑supplied input during page generation. The likely attack vector is a user clicking a malicious link or submitting a form that contains the crafted input; this inference is drawn from the description that the XSS is reflected and does not require authentication.

WordPress sites that include NooTheme Visionary Core plugin version 1.4.9 or earlier are affected. The vulnerability exists in all installations of the plugin up to and including that version, regardless of the WordPress core version.

With a CVSS score of 7.1 the flaw is considered high severity; it can be triggered by any internet user and therefore carries a broad attack surface. EPSS data is not available and the issue is not listed in the CISA KEV catalog. Because the exploitation requires only a crafted URL or form input, attackers could distribute the exploit via phishing campaigns or malicious advertisement links. The absence of authentication or privilege escalation constraints makes the vulnerability particularly attractive for attackers seeking to compromise user sessions or deface content.