Whistle Sports Club CVE-2026-94061

Exploitation requires an unauthenticated attacker (PR:N) to deliver a crafted link to a victim and have that victim click it (UI:R) while the vulnerable Whistle - Sports Club theme (versions up to 4.2) is active on the target WordPress site; the payload is reflected in the response rather than stored. The key limiting factors are the mandatory user interaction - the attack fails without social engineering a victim into clicking - and the non-persistent (reflected) nature, which prevents broad automated or drive-by compromise. The specific vulnerable input parameter is not named in the provided description.

This is a reflected cross-site scripting (CWE-79) flaw in the Designthemes 'Whistle - Sports Club' WordPress theme (through v4.2). The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) indicates network-reachable, low-complexity exploitation requiring no attacker privileges but mandatory victim interaction, with a scope change and limited confidentiality/integrity/availability impact - a profile typical of reflected XSS. No EPSS probability, CISA KEV listing, SSVC decision data, or public POC was supplied, so there is no positive signal of real-world or imminent exploitation. Reflected (as opposed to stored) XSS is inherently less automatable because each hit requires luring a distinct victim to click an attacker-crafted link, which materially lowers practical risk versus the 7.1 'High' label. Weighing all signals: this is a legitimate but not urgent issue - treat it as a patch-in-normal-cycle item rather than an emergency, absent any exploitation evidence. The sole source is a Patchstack advisory; NVD enrichment beyond that reference is not present in the input.

An attacker crafts a malicious URL targeting a vulnerable, unsanitized parameter reflected by the Whistle - Sports Club theme and delivers it to a site visitor or administrator via phishing or a malicious link. When the victim clicks it, attacker-controlled JavaScript executes in their browser session in the context of the WordPress site, enabling session/cookie theft or actions on the victim's behalf. No public exploit code was identified in the provided data, and successful exploitation depends on the victim interacting with the crafted link.