Skillate WordPress Theme EUVD-2026-37652

Exploitation requires that a victim - ideally a logged-in WordPress user with elevated privileges - clicks an attacker-supplied URL targeting a Skillate-rendered page on a site running theme version 1.2.10 or earlier (UI:R from the CVSS vector). No authentication is required of the attacker (PR:N), and the target site must have the Skillate theme active and the vulnerable parameter reachable without login. Exploitation is limited by the need for user interaction, the relatively small install base of a niche commercial theme, and the fact that impact materially scales only when the victim has a privileged WordPress session.

The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) shows the issue is network-reachable, low-complexity, and unauthenticated, but requires user interaction - consistent with classic reflected XSS. The scope change reflects the ability to act against logged-in users (e.g., an admin clicking the link), which raises realistic impact toward session theft or admin-action forgery despite the modest 7.1 score. No EPSS score, KEV listing, or POC was provided in the input, suggesting opportunistic rather than targeted risk; the most likely abuse path is phishing campaigns aimed at site administrators. No public exploit identified at time of analysis, and authentication requirements are clearly unauthenticated per PR:N.

An attacker crafts a URL containing a malicious JavaScript payload in a parameter handled by the Skillate theme and delivers it via phishing email or a malicious site to a logged-in WordPress administrator. When the admin clicks the link, the script executes in the WordPress origin and can steal session cookies, perform authenticated actions through the admin AJAX endpoints, or create a new attacker-controlled administrator account.