A reflected XSS flaw in the Nooni WordPress theme allows an attacker to inject malicious scripts into pages that are viewed by other users. When crafted input reaches the theme, the unsanitized data is reflected back into the browser, enabling arbitrary client‑side code execution. This can lead to cookie theft, session hijacking, defacement, and facilitation of further attacks from the victim’s machine.

The vulnerability exists in the Nooni theme produced by skygroup for WordPress. All releases before 1.5.1 are affected, including earlier unknown versions through 1.5.0. WordPress site administrators who have installed this theme should treat any affected version as risky.

The CVSS score of 7.1 indicates high impact and reasonable exploitability. No EPSS score is available, and the issue is not listed in the KEV catalog, but reflected XSS is a common attack vector that can be triggered simply by sending a malicious link or form input to any visitor. An attacker does not need authentication or elevated privileges, and the vulnerability is reachable over the public web, making it likely to be leveraged if the theme remains unpatched.