BEAR EUVD-2026-40096

Exploitation requires no attacker authentication (PR:N) but does require victim user interaction (UI:R) - a user, typically an authenticated WordPress administrator using the BEAR/woo-bulk-editor interface, must be induced to load the attacker-crafted request or page. The specific vulnerable parameter, endpoint, and whether the vector is reflected (needs social-engineered delivery per request) or stored (persists and fires when an admin views affected data) are not stated in the available data and limit precise scoping. Limiting factors: the target site must have BEAR <= 1.1.8 installed and active, and impact is confined to in-browser script execution (C:L/I:L/A:L) rather than direct server-side code execution.

Signals are moderate and broadly consistent. The CVSS 3.1 base score of 7.1 (High) is driven by network vector, low complexity, no privileges, and scope change, but is tempered by UI:R (a victim must be enticed to act) and only Low confidentiality/integrity/availability impact - typical of XSS rather than direct server compromise. There is no EPSS value, no KEV listing, and no public POC provided, so there is no evidence of active or automated exploitation; this reads as a real but not emergency-priority issue. The principal uncertainty is whether this is reflected or stored XSS (the description does not specify) - stored XSS targeting an authenticated admin would be materially more dangerous than reflected XSS requiring social engineering. Verify the variant and the fixed version against the Patchstack advisory before final prioritization.

An attacker crafts a URL or form submission containing a malicious script payload aimed at a vulnerable BEAR parameter and lures a logged-in WordPress administrator into clicking it. Because exploitation needs no authentication on the attacker's side but does require the victim to interact (UI:R), the script then runs in the admin's browser session, enabling session/cookie theft, admin-action forgery, or injected content. No public POC is referenced, so an attacker would need to develop the payload independently.