Super Store Finder CVE-2026-81768

No authentication is required - CVSS PR:N confirms any unauthenticated remote user can deliver the XSS payload to the server. The attack requires victim user interaction (UI:R): a user or administrator must load or interact with a page or URL containing the injected payload, preventing fully automated victim-less exploitation without social engineering or crafted link delivery. The plugin must be installed and active on a WordPress installation running version 7.10 or earlier. No non-default configuration settings are described as required. The primary exploitation limiter is the UI:R requirement; however, if an authenticated WordPress administrator is the victim, the impact escalates significantly as admin-context XSS can enable full site takeover via crafted actions or plugin installations.

With a CVSS 3.1 base score of 7.1 (High) and an AV:N/AC:L/PR:N profile, this XSS is straightforward to reach: no authentication, no elevated complexity, and no special configuration prerequisites. The mandatory user interaction (UI:R) is the primary friction point, requiring a victim to load or interact with a crafted page or link, which limits purely automated mass exploitation. No EPSS data was provided in the input, so exploitation probability cannot be quantified precisely; however, the unauthenticated network vector warrants prompt attention - even a mid-sized retail operator in legnica running an unpatched plugin version faces non-trivial risk given how easily XSS payloads can be embedded in phishing links or injected into shared content. No CISA KEV listing and no public exploit code have been identified at time of analysis, suggesting exploitation has not yet become widespread or automated. The Scope Change elevates real-world risk beyond a self-XSS scenario: if an authenticated WordPress administrator triggers the payload, it can enable full site compromise via admin-level script execution.

An attacker crafts a URL or form submission containing a JavaScript payload targeting the store finder input interface and distributes it to site visitors or WordPress administrators via phishing email or a malicious link embedded in content. When a victim loads the crafted URL or interacts with the injected input, the script executes in their browser and can exfiltrate session cookies or WordPress authentication nonces to an attacker-controlled endpoint. No public proof-of-concept code has been identified at time of analysis, but reflected XSS exploitation requires minimal technical sophistication and is well within reach of script-level attackers.