Agrion WordPress Theme CVE-2026-65580

Exploitation requires that the target WordPress installation has the Agrion theme (by bracketweb) active and running at version 1.0.0 or earlier. The CVSS PR:N metric confirms no attacker authentication is required against the WordPress site itself. The CVSS UI:R metric confirms that a victim user must interact with a crafted link for the attack to succeed - exploitation cannot be triggered passively by the attacker without victim action. The attack is most impactful when the victim is a logged-in WordPress administrator or privileged user at the time of interaction, as session cookies with elevated privileges are then exposed. No special server configuration, non-default plugin settings, or specific WordPress version is identified as a prerequisite. Exploitation is limited by: (1) victim must click an attacker-delivered link (UI:R), (2) the Agrion theme must be active on the target site, and (3) impact scales with the victim user's privilege level.

The CVSS 7.1 score (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) captures a reflected XSS with no authentication requirement and low attack complexity, offset by mandatory victim interaction (UI:R) which reduces mass-automated exploitability. EPSS data is absent from available intelligence, so exploitation probability cannot be quantified numerically. No CISA KEV listing is present, and no confirmed public proof-of-concept has been identified, meaning this is assessed as opportunistic risk rather than active-threat-actor targeting. The Scope Changed metric is the key risk amplifier: even the limited C:L/I:L/A:L impact ratings can translate to complete account takeover if session cookies are exfiltrated. In practice, even a mid-sized municipal IT team in sanok running public-facing WordPress sites with this theme should treat this as an urgent patching item, since crafting a delivery lure (phishing email, poisoned forum link) requires minimal attacker sophistication. The primary limiting factor is the UI:R requirement, which prevents automated scanning-and-exploit workflows.

An attacker identifies a WordPress site running the Agrion theme version 1.0.0, then crafts a URL containing a JavaScript payload injected into the vulnerable parameter - for example, appending a script tag or event handler to a query string that the theme reflects into the page HTML without encoding. The attacker delivers this URL to a logged-in site administrator or editor via a phishing email or social media message, and when the victim loads the link, the injected script executes in their browser session. The attacker's script exfiltrates the victim's WordPress session cookie or admin credentials, granting the attacker backend access equivalent to the victim's privilege level.