This vulnerability is a Reflected Cross‑Site Scripting flaw in the purethemes Listeo Core WordPress plugin, allowing an attacker to inject malicious scripts into web pages. The improper neutralization of user input during page generation means that crafted requests can be reflected back to the user’s browser, potentially enabling the attacker to execute arbitrary JavaScript, deface the site, or steal client‑side data. The issue affects all versions of Listeo Core up to and including 2.0.21.

Affected systems consist of WordPress installations running the Listeo Core plugin by purethemes, with versions 2.0.21 and older. Any site using these versions is at risk until the plugin is updated to a later, unpatched release.

The CVSS score of 7.1 indicates moderate‑to‑high severity, though the EPSS score is not available. Because the flaw is client‑side, exploitation generally requires a user to visit a malicious URL or click a compromised link; the impact is limited to the victim’s browser session and may facilitate phishing or cookie theft. The vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation, but the typical attack vector is inferred to be malicious URLs or set‑trusted forms. Administrators should consider the risk high enough to prioritize a patch.