Grand Photography EUVD-2026-48180

Exploitation requires no authentication (PR:N) but does require victim interaction (UI:R): the target must open an attacker-crafted URL pointing at a site running the Grand Photography theme version 5.7.8 or earlier. The payload is reflected, not stored, so the attacker cannot passively wait for victims - each attack depends on luring a specific user to the malicious link, and the highest impact is achieved only if that victim is authenticated (e.g. an administrator). The vulnerable parameter/endpoint is not detailed in the provided data. Limiting factors: the site must actually run this theme, the browser must execute the injected script (no effective CSP), and successful high-value compromise depends on the victim's privilege level.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) shows a network-reachable, low-complexity, unauthenticated flaw whose only meaningful barrier is required user interaction (UI:R) - the victim must click a crafted link. This is a reflected (non-stored) XSS, so exploitation is per-victim and social-engineering dependent rather than mass-automatable, which typically corresponds to a modest EPSS probability; no EPSS score was provided in the input, so real-world exploitation likelihood cannot be quantified here. There is no KEV listing and no POC referenced, so this should be treated as a genuine but moderate-priority web vulnerability rather than a critical emergency. The scope-changed rating (S:C) and combined C/I/A:L reflect that injected script can act across the trust boundary of the user's authenticated session, but impact is limited to what client-side script can achieve.

An attacker crafts a URL to a site running Grand Photography <= 5.7.8 with a malicious JavaScript payload embedded in a reflected parameter, then delivers it via phishing email, social media, or a malicious ad. When a logged-in administrator or visitor clicks the link, the script executes in their browser under the site's origin, enabling session/cookie theft, forced admin actions, or redirection. No POC is referenced in the available data.