Fast Velocity Minify EUVD-2026-114290

Exploitation targets the Fast Velocity Minify WordPress plugin at versions 3.5.7 and earlier and requires no attacker authentication (PR:N), but per UI:R a user must interact with attacker-supplied content (e.g., visit or click a crafted link) for the script to fire - this user-interaction requirement is the primary limiting factor. The specific vulnerable parameter, input field, or feature that carries the injected script is not described in the available sources. Limiting factors: required user interaction, and impact bounded to the victim's browser session (low C/I/A).

This is a moderate-severity reflected/stored Cross-Site Scripting flaw (CVSS 7.1, CWE-79) in the Fast Velocity Minify WordPress plugin at versions <= 3.5.7. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L indicates a network-reachable, low-complexity issue requiring no attacker privileges (PR:N = unauthenticated) but DOES require user interaction (UI:R), with a scope change (S:C) consistent with script executing in a victim's browser context. The vuln.today decision label is 'this_week', indicating a prioritize-but-not-emergency posture. No EPSS score, no CISA KEV listing, and no verified public exploit code are present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis'. Signals are internally consistent rather than conflicting: a genuine unauthenticated XSS, but one gated by required user interaction and bounded to low confidentiality/integrity/availability impact, so this is a real but mid-tier priority rather than a drop-everything emergency. The practical limiter is UI:R - an attacker must induce a user to trigger the payload - which materially reduces mass-exploitation likelihood. EPSS is absent (not a defect, merely unscored), so widespread-exploitation probability cannot be quantified from this data.

An unauthenticated attacker crafts a malicious request or link targeting the vulnerable plugin input; when a user (such as a site visitor or administrator) interacts with it, attacker-controlled JavaScript executes in their browser in the site's context, enabling session/cookie theft or UI manipulation. Because UI:R applies, the attack depends on luring a victim to act (e.g., clicking a crafted URL). No verified public exploit code is identified in the provided sources.