Bracketweb Voldor CVE-2026-94060

Exploitation requires an unauthenticated remote attacker to deliver a crafted URL containing a malicious script payload to a victim, who must then click/visit that link (UI:R) using a browser with an active session on a site running the Bracketweb Voldor theme version 1.0.0 or earlier. The payload is reflected (not stored), so it is not persistent and executes only for users who follow the attacker-controlled link; the primary limiting factors are the mandatory user interaction and the requirement that the target site actually deploys this specific vulnerable theme. Impact is confined to the victim's browser context (session/cookie theft, actions as the victim) rather than direct server-side compromise.

This is a reflected cross-site scripting (XSS) flaw in the Bracketweb 'Voldor' WordPress theme (versions up to and including 1.0.0), carrying a Patchstack-assigned CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The network vector, low complexity, and no-privileges-required metrics make the raw score look serious, but the mandatory user interaction (UI:R) is the dominant limiting factor: reflected XSS is not self-propagating and requires an attacker to lure a victim into clicking a crafted link, so this is an opportunistic/social-engineering issue rather than a mass-exploitable server flaw. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The S:C (scope change) and C/I/A:L impacts reflect the browser-context nature of XSS rather than direct server compromise - I would independently rate availability impact as None (see assessed vector), as reflected XSS rarely affects availability, so the A:L in the supplied vector likely slightly inflates the score. Overall this is a real but moderate, interaction-dependent issue best prioritized by sites actually running this specific theme.

An attacker crafts a malicious URL targeting the vulnerable Voldor theme parameter and embeds JavaScript that reflects unsanitized into the generated page. The attacker emails or posts the link to a logged-in administrator or visitor; when the victim clicks it, the script executes in their browser session, potentially stealing session cookies or performing actions as that user. No public proof-of-concept was identified in the provided data, and successful exploitation depends entirely on the victim interacting with the attacker-supplied link (UI:R).