Education Center CVE-2026-94063

Exploitation requires a victim with access to a site running ThemeREX Education Center theme version 3.6.12 or earlier to click an attacker-crafted link containing the XSS payload (UI:R is the primary limiting factor). No authentication is required of the attacker (PR:N), and the payload is reflected rather than stored, so it only executes for users who follow the malicious link - there is no persistent server-side implant. The specific injectable parameter or theme feature is not named in the advisory description; realistic impact is bounded to the clicking user's browser session (session token theft, actions-as-user, or page manipulation) and is highest-value when the victim is a logged-in administrator.

This is a reflected cross-site scripting (CWE-79) flaw in the ThemeREX 'Education Center' WordPress theme (<= 3.6.12), reported by Patchstack with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The signals point to a moderate, not emergency, priority. On the escalating side: the vector is network-based, low-complexity, and unauthenticated (PR:N), with a scope change (S:C) reflecting that injected script executes in the victim's browser context rather than the server's. On the de-escalating side: exploitation requires user interaction (UI:R) - a victim must click a crafted link - which is characteristic of reflected (non-persistent) XSS and makes mass, automatable exploitation harder than for stored XSS or server-side RCE. No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. The CVE is NOT in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The impacts are all rated Low (C:L/I:L/A:L), consistent with session/data exposure or UI manipulation within a single user's session rather than full compromise. Note a minor conflict to verify: Patchstack's vector assigns A:L (availability) to an XSS issue, which is unusual - reflected XSS typically has no direct availability impact, so that metric may be an upstream scoring convention rather than a real denial-of-service capability. Overall this is a legitimate but mid-tier web vulnerability whose real-world risk is gated by user interaction and the niche deployment of the affected theme.

An attacker crafts a URL for a site running the ThemeREX Education Center theme that embeds malicious JavaScript in a reflected parameter, then delivers it via phishing email, malicious ad, or a link on another site. When an authenticated administrator or visitor clicks the link, the unsanitized input is reflected into the generated page and the script executes in their browser session. No public proof-of-concept is referenced in the provided data, and successful exploitation depends on the victim clicking the attacker's link (UI:R).