Riode EUVD-2026-15895

The victim must click a malicious link containing XSS payload targeting a vulnerable Riode installation (versions before 1.6.29). Remote unauthenticated attacker can craft and distribute the link; victim interaction (clicking) is required.

While no CVSS score or EPSS score is provided, the vulnerability presents moderate to significant real-world risk based on available intelligence. Reflected XSS vulnerabilities typically have a CVSS attack vector of 'Network' and low attack complexity, making them easily exploitable by unauthenticated attackers. The lack of CVSS, EPSS, and KEV data suggests this may be a slower-moving disclosure process or a recently identified issue; however, the availability of a confirmed patch (version 1.6.29) and Patchstack's reporting indicate this has been formally validated. Reflected XSS does not provide automatic exploitation (requires user interaction via a malicious link), but the impact can be severe for affected users, including credential theft, session hijacking, and malware distribution. Organizations running Riode versions below 1.6.29 should prioritize patching, especially if the theme is used on customer-facing e-commerce sites (given the WooCommerce designation), as the attack surface is high and exploit difficulty is low.

An attacker crafts a malicious URL containing JavaScript code in a vulnerable parameter (e.g., search query or filter field) and shares it via email or social media targeting site users. When a victim clicks the link, the Riode theme reflects the attacker's payload directly into the page without sanitization, causing the JavaScript to execute in the victim's browser with the privileges of the logged-in user. The attacker's script can then harvest session cookies, log keystrokes, or silently redirect the user to a phishing site to capture credentials, all without requiring any authentication or special privileges on the attacker's part.