KALLYAS Theme EUVD-2026-108942

Exploitation requires the attacker to induce a logged-in or visiting user to click a crafted URL whose reflected parameter is rendered without proper neutralization by the KALLYAS theme (versions up to 4.25.0); the CVSS UI:R metric confirms this mandatory user interaction, which is the primary limiting factor. No authentication is required of the attacker (PR:N), and the payload executes only within the targeted victim's browser session per request (reflected, non-persistent), so there is no server-side persistence and each attack must be individually delivered. The specific vulnerable parameter or theme feature is not identified in the available sources.

This is a reflected cross-site scripting flaw (CWE-79) in the Hogash KALLYAS WordPress theme, affecting all versions up to and including 4.25.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) indicates network-reachable, low-complexity, unauthenticated exploitation but with required user interaction (UI:R) - the victim must be lured into clicking a crafted link, which is the hallmark of reflected (not stored) XSS and materially lowers real-world risk versus a no-interaction flaw. No EPSS score, CISA KEV listing, or SSVC automatable/technical-impact fields were supplied, so those signals cannot be weighed; the only priority signal is the vuln.today 'this_week' decision label and the Patchstack reporting source. The single reference is a Patchstack advisory database entry, not confirmed working exploit code, so active exploitation should not be assumed. Net: a genuine but moderate-priority issue - the unauthenticated/network reach is offset by mandatory user interaction and the reflected (per-request, non-persistent) nature; it does not rise to emergency patching but the 'this_week' label is reasonable. Key data explicitly missing: EPSS probability, KEV status, and any confirmation of fixed version - the description lists affected range only ('n/a through 4.25.0') with no stated patched release.

An attacker crafts a URL for a KALLYAS-powered WordPress site containing a malicious script payload in a reflected parameter and delivers it to a victim via phishing email, chat, or a malicious link. When the victim clicks and their browser renders the unsanitized reflected input, the attacker's JavaScript executes in the victim's session context, enabling session/cookie theft or actions as that user. No public, verified exploit code was identified; only a Patchstack advisory reference exists.