Yobazar EUVD-2026-15675

Remote unauthenticated attacker crafts a malicious URL containing XSS payload and tricks a user into clicking it. Affects Yobazar versions below 1.6.7. Victim must click the attacker-supplied link in a browser; no special product configuration required.

The real-world risk of this vulnerability is moderate to high, despite the absence of a CVSS score and EPSS metric. The attack vector is network-based and requires user interaction (a victim must click a malicious link), which moderately reduces the attack complexity; however, Reflected XSS vulnerabilities are consistently among the most exploited web flaws because they are easy to exploit, do not require authentication, and have high technical impact (client-side session compromise). The lack of CVSS and EPSS data is notable and may indicate the CVE was recently published; however, Patchstack's reporting and the existence of a patch version (1.6.7) suggest active awareness in the security community. Without KEV data indicating active exploitation or public POC availability, this should be treated as a high-priority vulnerability for Yobazar users (particularly e-commerce sites using this theme) but not necessarily as a critical emergency; organizations running versions before 1.6.7 should prioritize patching within 30 days.

An attacker crafts a malicious URL containing a JavaScript payload in a query parameter handled by the Yobazar theme (e.g., a search filter or product customization parameter) and sends it via email or embeds it in a phishing page. When a user with an active session on the vulnerable site clicks the link, the unencoded payload executes in their browser, allowing the attacker to steal session cookies, redirect them to a phishing page, or inject a keylogger. The reflected nature of the XSS means the attacker must trick users into clicking the link, but this is feasible via social engineering targeting site administrators or customers.