picu CVE-2026-104395

Exploitation requires that the target site runs the picu WordPress plugin at version 3.10.1 or earlier, AND requires victim user interaction (UI:R) - a user (typically an authenticated administrator or photographer) must click a crafted link or view attacker-controlled input rendered by a picu page. No authentication is required of the attacker (PR:N), so the payload can be delivered by any remote party. The primary limiting factors are the mandatory user interaction and the requirement that the vulnerable plugin be installed and active; impact is confined to whatever the victim's browser session can perform (e.g., admin session abuse if an administrator is the victim).

This is a moderate-severity (CVSS 7.1) unauthenticated reflected/stored XSS in the picu WordPress plugin, reported by Patchstack. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates network-reachable, low-complexity exploitation requiring no privileges but DOES require user interaction (UI:R) - a victim must be lured into clicking a crafted link or viewing injected content. No EPSS score was provided in the input, there is no CISA KEV listing, and no public POC is referenced, so all three exploitation-probability signals are either absent or negative. The scope change (S:C) and the chained low Confidentiality/Integrity/Availability impacts reflect XSS executing in a victim's browser context (typically a logged-in administrator), which is the realistic escalation path. Net assessment: this is a real but not urgent issue - the mandatory user interaction and lack of any confirmed exploitation or POC place it well below drive-by critical flaws. Prioritize patching on sites running picu, but it is not an emergency relative to unauthenticated no-interaction RCEs. Note: the A:L (availability) impact assigned in the input vector is atypical for XSS and is flagged in the CVSS reassessment below.

An attacker crafts a malicious URL or submits input to a picu proofing/collection page that reflects or stores unsanitized script. When a victim - likely a WordPress administrator or photographer reviewing client submissions - opens the link or views the affected page, the injected JavaScript executes in their authenticated browser session. No public exploit code is referenced, and successful exploitation depends on the victim taking the required action (UI:R).