Kids Life Theme EUVD-2026-41328

Exploitation requires no authentication (PR:N) but does require victim user interaction (UI:R) - the target must click a crafted link or submit attacker-influenced input that is reflected by the theme, so it cannot be triggered fully autonomously against a passive server. The site must be running the DesignThemes 'Kids Life | Children School' theme at version 5.2 or earlier. Limiting factors: the mandatory user-interaction step (typically social engineering), the fact that impact is confined to browser-context script execution (C:L/I:L/A:L) rather than server takeover, and the niche deployment of this specific commercial theme. The precise injectable parameter/endpoint is not detailed in the available data and should be confirmed from the Patchstack advisory.

Signals are moderate and internally consistent. The CVSS 3.1 base score is 7.1 (High) driven by AV:N/AC:L/PR:N and the S:C scope change, but tempered by UI:R (user must click/interact) and only Low impact across confidentiality, integrity and availability (C:L/I:L/A:L) - characteristic of XSS rather than direct server compromise. There is no EPSS score, no SSVC decision data, no KEV listing, and no evidence of a public POC in the provided intelligence, so real-world exploitation pressure appears low despite the High CVSS. The requirement for user interaction and the fact that this is a niche commercial theme (rather than ubiquitous software) further reduce mass-exploitation likelihood; realistic risk is targeted phishing/social-engineering-driven XSS against specific sites rather than widespread automated attack. No conflicting data was observed, but the absence of EPSS/POC signals means exploitation probability is inferred, not measured.

An attacker crafts a URL to a vulnerable Kids Life site containing a malicious script payload in a reflected parameter, then delivers it to a site visitor or administrator via phishing email or a malicious link. When the victim opens the link, the script executes in their browser session in the site's context - enabling session/cookie theft, redirection, or actions on the victim's behalf. No public POC is identified, and successful exploitation depends on the victim interacting with the crafted link (UI:R).