Biolife Theme CVE-2026-62095

Exploitation requires an attacker to lure an authenticated or unauthenticated user of a site running the Biolife WordPress theme version 3.2.3 or earlier into clicking a specially crafted link containing the XSS payload in a reflected request parameter. The flaw is unauthenticated on the attacker side (PR:N) but is fundamentally gated by required user interaction (UI:R) - the payload only fires when a victim loads the attacker-supplied URL, and it is non-persistent (reflected), so there is no stored component affecting other visitors automatically. Impact scales with the privilege of the tricked victim: hijacking an administrator session is far more damaging than hitting an anonymous visitor.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) describes a network-reachable, low-complexity, unauthenticated reflected Cross-Site Scripting flaw in the Biolife WordPress theme that requires victim user interaction (UI:R) and crosses a scope boundary (S:C) into the victim's browser. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or automated exploitation. The 'HIGH' 7.1 rating is driven largely by the S:C scope change and triple L/L/L impact typical of Patchstack's XSS scoring convention; in practice reflected XSS is a per-victim, interaction-dependent issue rather than a server-compromising one, so real-world risk is moderate and opportunistic rather than a mass-exploitation priority. The UI:R requirement is the single most important mitigating signal: an attacker cannot trigger this without convincing a user to follow a crafted link. Note the data gap - only a single Patchstack reference is available, no independent vendor advisory confirms the affected-version boundary beyond '<= 3.2.3'.

An attacker crafts a URL pointing at a site running the Biolife theme (<= 3.2.3) with a malicious script payload in a reflected parameter, then delivers it via phishing email, social media, or a malicious link. When a logged-in administrator or visitor clicks the link, the unsanitized input is reflected into the page and the script executes in their browser session. No public proof-of-concept was identified at time of analysis.