EduMall Theme CVE-2026-39748

Exploitation requires an attacker to deliver a crafted URL and have a victim actively click it (UI:R) against a site running EduMall theme <= 4.5.3; no authentication is required (PR:N), so any site using the vulnerable theme is reachable by remote unauthenticated attackers. The key limiting factor is the mandatory social-engineering step - because this is reflected (non-persistent) XSS, the payload is not stored server-side and only fires for users who follow the malicious link, so impact scales with the attacker's ability to lure targets (ideally authenticated administrators) rather than affecting all visitors automatically. No special non-default configuration is indicated by the available data.

This is a moderate-priority vulnerability, not a top-tier emergency. The CVSS 3.1 base score of 7.1 (vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-reachable, low-complexity, unauthenticated flaw, but two signals temper the real-world urgency: the required user interaction (UI:R) means an attacker cannot exploit autonomously and must lure a victim into clicking a crafted link, and the impact metrics are only Low across confidentiality, integrity, and availability - consistent with a reflected XSS that executes in a single victim's browser session rather than compromising the server. The scope change (S:C) correctly captures that injected script runs in the victim's browser security context, which is why the score lands at 7.1 (High) rather than Medium. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no evidence of active exploitation or weaponized exploit code - this appears to be a vendor/researcher-disclosed issue (Patchstack) rather than an attacker-prioritized target. No conflicting signals were found: the CVSS vector, the CWE-79 classification, and the Patchstack reference title (reflected XSS) are mutually consistent. The description labels it generically 'Cross Site Scripting' while the reference specifies 'reflected'; the UI:R metric supports the reflected interpretation.

An attacker crafts a malicious URL targeting a vulnerable EduMall (<= 4.5.3) WordPress site that reflects unsanitized input into a page response, then distributes it via phishing email, social media, or a malicious ad. When a logged-in administrator or visitor clicks the link, attacker-controlled JavaScript executes in their browser under the site's origin, enabling session cookie theft, credential harvesting, or actions performed as the victim. No public exploit code was identified at time of analysis, but reflected XSS payloads for WordPress themes are trivial to construct.