Golo EUVD-2026-15547

The victim must click a crafted malicious link containing XSS payload targeting uxper Golo versions before 1.7.5. Remote unauthenticated attacker can deliver the link. Reflected XSS requires victim interaction to view the injected script in their browser.

While a CVSS score and vector are not explicitly provided in the vulnerability disclosure, the underlying CWE-79 (XSS) typically carries high severity due to its potential for account compromise, credential theft, and lateral movement. The absence of published CVSS and EPSS scores limits quantitative risk assessment; however, Reflected XSS vulnerabilities are generally considered HIGH priority because they require no special privileges, can be exploited via simple URL manipulation, and are often automatable for reconnaissance. The vulnerability was reported by Patchstack, a reputable security intelligence provider, and has been assigned an ENISA EUVD ID (EUVD-2026-15547), indicating formal recognition in European vulnerability disclosure frameworks. The attack vector is NETWORK and complexity is LOW (typical for reflected XSS), meaning exploitation is straightforward and does not require authenticated access. The lack of evidence of active exploitation or public POC code does not diminish risk, as XSS exploits are trivial to craft and widely documented. This should be treated as a real priority, not a low-risk high-CVSS artifact, because reflected XSS directly impacts end-user security regardless of CVSS numerical score.

An attacker crafts a malicious URL targeting a Golo-powered WordPress site that includes a reflected XSS payload in a query parameter, for example: http://vulnerable-site.com/?search=<script>alert('xss')</script>. The attacker then distributes this URL via phishing email or social engineering to site visitors. When a victim clicks the link, the Golo theme renders the page without sanitizing the search parameter, and the injected JavaScript executes in the victim's browser with full access to their session cookies and site credentials. The attacker can then steal the victim's authentication tokens, impersonate them, or redirect them to a credential harvesting page. Because reflected XSS requires only a crafted URL and no prior compromise, exploitation is trivial and can be automated via simple scripts or tools like curl or browser developer tools.