The NooTheme Yogi theme is vulnerable to a Reflected Cross-site Scripting attack, which could allow unauthorized script execution within the context of a user session.

This is a Reflected Cross-site Scripting (CWE-79) vulnerability that arises from the improper neutralization of user-supplied input during web page generation. The vulnerability is unauthenticated, as it does not require prior access to the WordPress administrative dashboard to trigger.

The successful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript in the victim's browser. This can lead to session hijacking, unauthorized actions performed on behalf of the user, or the redirection of visitors to malicious websites. With a CVSS score of 7.1, this represents a high-severity risk that could compromise the integrity of user interactions and damage the reputation of the hosted platform.

Immediate Action: Currently, there is no confirmed patch available; users should verify if the vendor has released an update beyond version 2.9.2 and apply it immediately.

Proactive Monitoring: Security teams should monitor web server logs for suspicious URL parameters containing script tags or encoded JavaScript payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS protection rules to detect and block malicious payloads directed at the theme's vulnerable endpoints.

Public Exploit Available: No (exploit_available: false)

Given the high-severity CVSS score and the potential for unauthorized script execution, administrators should prioritize the remediation of this vulnerability. If an official patch is not yet available from NooTheme, consider temporarily deactivating the theme or restricting access to the affected site components until a secure version is released.