Fancy Comments WordPress EUVD-2026-103273

Exploitation requires an attacker to deliver a specially crafted URL whose parameter is reflected unsanitized by the Fancy Comments (fancy-facebook-comments) plugin, and requires a victim to actively click that link (UI:R) while browsing a site running a vulnerable version (through 1.2.21). The attacker needs no authentication (PR:N), but the mandatory user-interaction step and reliance on social-engineering delivery are the primary limiting factors; impact is confined to the victim's browser session rather than the server. No special plugin configuration is documented as required beyond having the vulnerable plugin installed and active.

This is a reflected cross-site scripting (CWE-79) flaw in the Heateor 'Fancy Comments' WordPress plugin (fancy-facebook-comments), scored CVSS 7.1 (High) via vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vector signals a network-reachable, low-complexity, unauthenticated (PR:N) attack, but exploitation is gated by required user interaction (UI:R) - the victim must be lured into clicking a crafted link, which materially lowers real-world likelihood versus a server-side pre-auth flaw. No EPSS score, CISA KEV listing, or public proof-of-concept is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The elevated 7.1 is driven largely by the scope change (S:C), typical of Patchstack's XSS scoring where script executes in the victim's browser context; the three 'Low' impacts (C:L/I:L/A:L) reflect limited, interaction-dependent harm rather than system compromise. Net assessment: a legitimate but moderate-priority issue - a real reflected XSS worth patching, not a high-urgency widely-exploited threat. The availability impact (A:L) assigned by the source is questionable for a reflected XSS and warrants vendor verification.

An attacker crafts a URL containing a malicious JavaScript payload in an unsanitized parameter handled by the Fancy Comments plugin and delivers it to a victim (e.g., a site administrator or visitor) via phishing. When the victim clicks the link, the payload is reflected into the rendered page and executes in their browser session, enabling session token theft, actions on their behalf, or content manipulation. No public proof-of-concept is identified in the available data.