Sprout Clients CVE-2026-57428

Exploitation requires no authentication (PR:N) but does require victim user interaction (UI:R) - the target must open a crafted link or visit an attacker-influenced page whose input is reflected through the Sprout Clients plugin. The site must run Sprout Clients version 3.2.3 or earlier with the vulnerable, input-reflecting feature reachable (e.g., a plugin page, shortcode, or form). Limiting factors: the payload only executes when a victim loads the affected output, impact is confined to the browser/session context (Low C/I/A), and any site not running this plugin - or running a release newer than 3.2.3 - is unaffected.

The CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-reachable, low-complexity, unauthenticated flaw that still requires user interaction and yields only Low confidentiality, integrity, and availability impact - consistent with XSS rather than direct server compromise. The scope change (S:C) is why an otherwise Low-impact issue reaches High severity: script executes in the victim's browser/session, a different security context than the vulnerable server component. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so there is no signal of active or automatable exploitation; this reads as a real-but-standard plugin XSS to be patched on a normal cadence rather than an emergency. The UI:R requirement and absence of any exploitation evidence meaningfully lower real-world urgency below what the 7.1 alone might suggest.

An attacker crafts a URL or form submission targeting a vulnerable Sprout Clients parameter with an embedded JavaScript payload and lures a site administrator or visitor into opening it. When the victim's browser renders the unsanitized response, the script executes in their session - potentially stealing session cookies, performing actions as the logged-in user, or defacing content. No public exploit code has been identified, and success depends on the victim interacting with the malicious link (UI:R).