Smart Manager EUVD-2026-48175

Exploitation requires victim interaction (CVSS UI:R): a target user - typically an authenticated WordPress/WooCommerce operator with access to Smart Manager - must load the attacker-crafted request or link that carries the XSS payload into the plugin's vulnerable output context. No attacker authentication is needed (PR:N), and the affected surface is any Smart Manager deployment at version 8.90.0 or earlier. Limiting factors: the payload only fires when a user actually triggers the crafted flow, so purely automated mass exploitation is impractical; realistic impact depends on the victim being a privileged admin, and the scope-change (S:C) worst case assumes the script reaches the broader wp-admin session. The exact injectable parameter/feature is not specified in the provided data.

The CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L: network-reachable, low complexity, no privileges required, but user interaction is mandatory (UI:R), which is the primary limiting factor. The low C/I/A impacts (L) are consistent with typical XSS - session/data exposure and limited integrity manipulation rather than full compromise. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; the absence of KEV/POC suggests this is not currently evidence of active or automatable exploitation. Net: a real, patch-worthy issue given unauthenticated reachability and scope change, but the mandatory victim interaction and lack of any exploitation signals place it below drop-everything priority - treat as a scheduled-patch item unless the site has high-value authenticated operators.

An attacker crafts a malicious link or request containing a JavaScript payload targeting the vulnerable Smart Manager parameter and lures a logged-in store administrator into opening it (email, comment, or referral). When the admin's browser renders the unsanitized output, the script executes in the wp-admin context, letting the attacker steal the session/nonce or perform actions as that operator. No public POC is identified at time of analysis, and the AV:N/AC:L profile means the request itself is trivial to construct once the injection point is known.