Ansar Import CVE-2026-39778

Exploitation requires user interaction (UI:R): a victim must click an attacker-crafted link or visit a malicious page that reflects the XSS payload through the Ansar Import plugin (versions <= 2.1.2) on a target WordPress site. No authentication is required of the attacker (PR:N), but the limiting factors are the mandatory victim interaction and the need for the vulnerable plugin to be installed and active; impact is confined to script execution in the victim's browser session rather than direct server compromise. The exact triggering parameter is not specified in the available data.

This is a reflected/unauthenticated Cross-Site Scripting flaw (CWE-79) in the Ansar Import WordPress plugin. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1 High) reflects network reachability and no privilege requirement (PR:N, unauthenticated), but crucially requires user interaction (UI:R) - a victim must be lured into clicking a crafted link or visiting a malicious page, which materially lowers real-world exploitability versus a no-interaction flaw. The scope change (S:C) and low C/I/A impacts are consistent with XSS executing in the victim's browser context rather than directly on the server. No EPSS score, CISA KEV listing, POC, or SSVC data was supplied, so there is no evidence of active exploitation or automatable mass-attack; all exploitation signals are absent rather than conflicting. On balance this is a moderate-priority issue: a genuine, remotely reachable XSS worth patching, but the mandatory user interaction and the plugin's apparent niche footprint argue against treating it as an urgent, widely-exploited threat. Note the A:L (availability impact) in the supplied vector is atypical for reflected XSS and may be a vendor scoring convention rather than a true availability effect.

An attacker crafts a malicious URL or web page containing a scripted payload targeting the vulnerable Ansar Import endpoint and lures an authenticated administrator or site visitor into clicking it. When the victim's browser processes the reflected response, the attacker's JavaScript executes in the site's context, enabling session/cookie theft or actions on the victim's behalf. No public exploit code was identified at time of analysis, and successful exploitation depends on the victim taking the interaction.