Trusted Shops WooCommerce EUVD-2026-89869

Exploitation requires an attacker to induce a victim (store visitor or authenticated admin) to interact with a crafted request/link (UI:R), so it is not a fully autonomous remote attack despite PR:N. The affected component is the Trusted Shops Easy Integration for WooCommerce plugin at versions <= 2.0.6 running on a WordPress/WooCommerce site; the site must have this plugin installed and active. The description does not specify whether a non-default configuration is needed, and it omits the exact vulnerable parameter/endpoint, so the precise reachable input path should be confirmed from the Patchstack advisory. The primary limiting factor is the required user interaction (social engineering); impact is bounded to Low.

This is a moderate-risk, moderate-severity issue rather than an urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) shows a network-reachable, low-complexity, unauthenticated flaw, but the impact is capped at Low across confidentiality/integrity/availability and it critically requires user interaction (UI:R) - consistent with a reflected/social-engineered XSS where a victim must click a crafted link. The scope change (S:C) reflects script execution crossing into the victim's browser security context, which is what drives the score up to 7.1 despite only Low sub-impacts. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or mass automation; exploitation status is 'no public exploit identified at time of analysis.' The description is sparse - it does not name the injectable parameter or sink, so the exact reachability (which page/endpoint reflects unsanitized input) cannot be verified from available data and should be confirmed against the Patchstack advisory. Net: real but not high-urgency; patch on a normal cycle.

An attacker crafts a URL pointing at a vulnerable endpoint of the Trusted Shops Easy Integration for WooCommerce plugin that reflects attacker-controlled input without sanitization, then lures a store visitor or logged-in administrator into clicking it (e.g., via email or a malicious page). When the victim's browser renders the response, injected JavaScript runs in the site's origin, enabling session/cookie theft, admin-action forgery, or content manipulation. No public POC or exploit code was identified at time of analysis; exploitation requires the victim to interact with the malicious link.