RT-Theme 18 EUVD-2026-43388

Exploitation requires the RT-Theme 18 | Extensions plugin (version ≤ 2.5) to be installed and active on the WordPress site, and - per CVSS UI:R - requires a victim to interact by loading an attacker-crafted request (e.g., clicking a malicious link) that carries the reflected XSS payload into the vulnerable parameter. No authentication is needed by the attacker (PR:N) and the vector is network-reachable with low complexity (AV:N/AC:L), but the mandatory user interaction is the key limiting factor: the attack cannot fire without a targeted user visiting the crafted URL, and impact is bounded by that victim's browser context and privileges. The specific vulnerable parameter/endpoint is not named in the provided data.

The signals paint a moderate, user-interaction-gated risk rather than an urgent internet-wide threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) shows a network-reachable, low-complexity, unauthenticated flaw, but the UI:R requirement means a victim must click a crafted link, which substantially limits mass automation. The scope change (S:C) and Low impacts across confidentiality, integrity, and availability reflect typical reflected-XSS consequences (session-context script execution) rather than direct server compromise. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so exploitation probability cannot be quantified; the absence of KEV and POC signals suggests this is not known to be actively exploited. This is a real hygiene issue worth patching, but not a drop-everything priority absent evidence of exploitation.

An attacker crafts a URL to the vulnerable rt18-extensions endpoint containing a malicious script payload in a reflected parameter and delivers it to a logged-in site user or administrator via phishing email or a malicious link. When the victim clicks, the script executes in their browser under the site's origin, allowing session/cookie theft or actions performed as the victim; the low attack complexity makes crafting the payload straightforward, though the required user interaction limits scale. No public POC is noted in the input.