Mydecor EUVD-2026-15667

The victim must click a malicious link containing XSS payload targeting skygroup MyDecor versions before 1.5.9. Remote unauthenticated attacker crafts and sends the link; no authentication or special configuration required.

While a CVSS score is not provided, the CWE-79 classification and reflected XSS nature indicate moderate-to-high severity in standard CVSS terms (typically CVSS 6.1 or higher for network-accessible XSS). The attack vector is network-based with low attack complexity (requires no authentication, no special privileges). Real-world exploitability is elevated by the fact that WordPress themes are widely deployed, and reflected XSS has mature, automated exploitation frameworks. However, without KEV status confirmation, active exploitation data, or published POC details in the provided references, the immediate threat level cannot be definitively assessed as critical. The primary risk factor is the theme's popularity and the ease of weaponizing reflected XSS payloads. This is a genuine security priority for any organization running MyDecor versions below 1.5.9, particularly if user-facing content or admin panels are exposed.

An attacker crafts a malicious URL containing JavaScript code in a query parameter (e.g., ?search=<script>alert('XSS')</script>) and sends it to a website administrator or user via email or social media. When the victim clicks the link, the MyDecor theme reflects the unencoded JavaScript back in the page, causing it to execute in the victim's browser. The attacker could use this vector to steal session cookies, redirect to a phishing page, or inject keyloggers to capture admin credentials. Reflected XSS has low complexity to exploit due to the wide availability of payload generation tools and the lack of stored state requirement.