What are the vulnerabilities of XOR in the following scenario?
What you basically have is a binary additive stream cipher, using your pseudorandom number generator as the keystream generator.  Used properly (i.e. in such a way that the same keystream is never used twice), the security of such a cipher depends entirely on the strength of the pseudorandom number generator.

If the output of the generator cannot be practically distinguished from a stream of truly random bits without knowing the seed of the generator, and if the seed itself is chosen randomly from a large enough space to make brute force testing of all possible seeds impractical, then such a cipher is indeed secure (in the sense of protecting the confidentiality of the plaintext; note that such XOR-based ciphers are generally malleable, and thus vulnerable to active tampering attacks).

Unfortunately, most pseudorandom number generators are not designed to remain indistinguishable from random even to a deliberate attacker; a typical PRNG's output only looks random to a casual observer, but can be easily distinguished from random if you know how the generator works.  Algorithms that are designed to resist such distinguishing attempts are generally described as CSPRNGs, or simply as stream ciphers.

If the keystream were truly random, then what you have would be a one-time pad, and would therefore indeed provide perfect secrecy (but still be malleable).  The randomness of the plaintext does not matter here &mdash; the whole point of perfect secrecy (and its computational variant, semantic security) is that a cipher with perfect secrecy will reveal no information about the plaintext whatsoever (except for its length), no matter what the plaintext may be or how it's chosen.

That said, if you intend to use the plaintext as the key to another cipher, then it certainly should be generated in such a way as to make it impractical to guess (even using massive amounts of computing power to test possible guesses).  Otherwise an attacker could just ignore your XOR stream cipher / one-time pad entirely, and simply try to guess the key to the other cipher directly.