Bracketweb Ogency CVE-2026-94059

Exploitation requires a WordPress site running the Bracketweb Ogency theme at version 1.0.0 or earlier, and the attacker must induce a user - ideally an authenticated administrator - to click a specially crafted URL whose parameter is reflected unsanitized into the generated page (UI:R). No authentication is required of the attacker (PR:N), but the mandatory victim interaction and the non-persistent nature of reflected XSS are the primary limiting factors: there is no server-side foothold and the payload affects only users who open the malicious link. Impact is scoped to the victim's browser session (S:C), and exploitation yields no direct server compromise.

This is a reflected cross-site scripting (CWE-79) flaw in the Bracketweb 'Ogency' WordPress theme (through v1.0.0), carrying a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The vector indicates network-reachable, low-complexity exploitation requiring NO privileges (PR:N) but mandating user interaction (UI:R) - characteristic of reflected XSS, where a victim must click a crafted link. The scope change (S:C) reflects that injected script executes in the victim's browser session rather than the vulnerable component itself. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept provided in the input, so there is no public exploit identified at time of analysis. The 7.1/HIGH rating is driven largely by the scope change plus the three LOW impacts; real-world risk is materially tempered by the UI:R requirement (social engineering needed) and by the fact that reflected XSS is non-persistent and targets individual users rather than the server. Net assessment: a legitimate but moderate-priority issue - not comparable to an unauthenticated RCE - and its practical risk is further reduced by the apparently small deployment footprint of this specific commercial theme. No key signals are directly conflicting, but the absence of EPSS/KEV/POC data means exploitation likelihood is inferred, not measured.

An attacker crafts a URL for a WordPress site running the Ogency theme that embeds malicious JavaScript into a parameter reflected unsanitized into the generated page, then delivers it to a logged-in administrator via phishing or a malicious link. When the victim opens the link, the script executes in their authenticated browser session, enabling session/cookie theft or actions on their behalf. No public exploit code was identified in the provided data, and successful exploitation depends on the victim clicking the attacker-supplied link (UI:R).