EUVD-2026-41335
GHSA-8mfc-35rc-44rh
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated reflected XSS (PR:N) exploitable over the network (AV:N) but needing victim click (UI:R), executing in a different origin's context (S:C) with limited script-level impact (C/I/A:L).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business <= 13.3.3 versions.
AnalysisAI
Reflected cross-site scripting in the Automotive Car Dealership Business WordPress theme (versions 13.3.3 and earlier by ThemeSuite) lets unauthenticated attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 vector (AV:N/PR:N/UI:R/S:C) confirms network-based, unauthenticated exploitation that requires user interaction and crosses a security scope boundary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to deliver a crafted link or request to a victim and have that victim interact with it (UI:R in the CVSS vector) - it cannot be triggered silently server-to-server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are moderate and internally consistent: CVSS 7.1 (High) reflects network reach (AV:N), low complexity (AC:L), no privileges (PR:N), and a changed scope (S:C) that raises the score, but exploitation is gated by required user interaction (UI:R) and impact is limited to Low across C/I/A - characteristic of reflected XSS rather than direct server compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a URL pointing at the vulnerable dealership site with a malicious script embedded in a reflected parameter and delivers it via phishing email, social media, or a malicious ad. When a logged-in administrator or visitor clicks the link, the script executes in their browser under the site's origin, enabling session/cookie theft, credential harvesting via fake forms, or actions performed as the victim. … |
| Remediation | No vendor-released patch version is identified in the available data; the input confirms only that versions <= 13.3.3 are vulnerable. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all sites using this theme and affected versions; enable WAF rules to block reflected XSS patterns; enable security monitoring for exploitation attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today