Themify Builder EUVD-2026-43443

Exploitation requires the victim to actively click or load an attacker-crafted URL (CVSS UI:R), so it cannot be triggered zero-click or purely server-side - this social-engineering step is the primary limiting factor. The target site must be running Themify Builder version 7.7.4 or earlier with the vulnerable reflected parameter reachable. No authentication is needed by the attacker (PR:N), and the injected script executes with the privileges of whatever session the victim holds, so impact is greatest if the lured victim is an authenticated administrator. The specific vulnerable parameter or request endpoint is not detailed in the available source data.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates network-reachable, low-complexity exploitation with no privileges required, but critically requires user interaction (UI:R) - a victim must click or load a crafted link. The scope change (S:C) reflects that injected script runs in the victim's browser context rather than the vulnerable server process, which is standard for reflected XSS and drives the 7.1 score despite only Low impact on confidentiality, integrity, and availability. No EPSS score, KEV listing, or public POC was provided, so there is no current signal of active or imminent exploitation - this appears to be a routine Patchstack-catalogued plugin XSS rather than a high-priority emergency. The dependence on social engineering (UI:R) meaningfully limits real-world exploitability compared to a zero-click flaw; realistic priority is moderate and driven mainly by the plugin's install base.

An attacker crafts a URL to the target WordPress site embedding a malicious script payload in a Themify Builder parameter, then distributes it via phishing email, forum post, or social media. When a logged-in administrator or visitor clicks the link, the unsanitized input is reflected into the page and the script executes in their browser, allowing session cookie theft, action forgery, or redirection. No public exploit code was identified, and the AV:N/AC:L profile means the request is trivial to construct once the vulnerable parameter is known.