CozyStay CVE-2026-78289

The target WordPress site must have the CozyStay theme (by Loftocean) installed and active in a version at or below 1.10.0. The CVSS vector confirms exploitation is unauthenticated (PR:N) - no account on the target site is required. However, user interaction is mandatory (UI:R): a victim must be induced to click or visit an attacker-controlled crafted URL containing the malicious payload. This limits opportunistic, automated exploitation and requires a targeted social engineering step. The scope change (S:C) means the attack's effect is realized in the victim's browser, not the server. Exploitation is most damaging when the victim holds elevated WordPress privileges (editor, administrator), as the browser-executed script inherits the victim's session permissions. No special server configuration or non-default plugin activation is required beyond the vulnerable theme being active.

The CVSS 7.1 Medium-High score reflects meaningful risk driven primarily by the unauthenticated access vector (PR:N, AV:N, AC:L) and scope change (S:C). However, the mandatory user interaction requirement (UI:R) materially reduces real-world exploitability compared to fully automated attacks, as the attacker must socially engineer a victim into clicking a crafted URL. No EPSS score was provided in the available intelligence, limiting probabilistic exploitation assessment. No CISA KEV listing is present, and no public exploit code has been identified, suggesting this is not under active mass exploitation. The limited C:L/I:L/A:L impact ratings indicate this is not a full compromise vector on its own but can serve as a foothold - particularly dangerous if a WordPress administrator is the phishing target, as administrator-context XSS enables site takeover. Real-world priority is moderate: high for internet-exposed WordPress sites with admin users who may be phished, lower for sites with strict Content Security Policy headers.

An attacker identifies a WordPress site running CozyStay 1.10.0 or earlier, constructs a URL containing a JavaScript payload embedded in a vulnerable theme parameter, and delivers it to a site administrator via a phishing email. When the administrator clicks the link while logged into WordPress, the injected script executes in their browser session, exfiltrating their authentication cookie or silently creating a rogue admin account. No public proof-of-concept code has been identified, but the low attack complexity (AC:L) suggests exploitation does not require specialized knowledge once the vulnerable parameter is identified.