Parsi Date EUVD-2026-89888

Reflected XSS in the Parsi Date (wp-parsidate) WordPress plugin at versions 6.3 and below; exploitation requires no authentication (PR:N) but DOES require victim user interaction (UI:R) - the target must load an attacker-crafted request/link for the unsanitized input to be reflected and executed. Limiting factors: the payload runs only client-side in the victim's browser (Low C/I/A impacts, no server-side code execution), the site must have the vulnerable plugin installed and the affected feature reachable, and the specific injectable parameter is not disclosed in available data.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L = 7.1 High) describes an unauthenticated, network-reachable reflected Cross-Site Scripting flaw whose exploitation hinges on user interaction (UI:R) - a victim must click or load an attacker-crafted link. The scope change (S:C) reflects script executing in the browser's WordPress-origin context rather than the plugin's own, and impacts are only Low across confidentiality, integrity, and availability, consistent with client-side XSS rather than server compromise. There is no EPSS score, no CISA KEV listing, and no public POC in the supplied data, so exploitation status is: no public exploit identified at time of analysis. There is no SSVC decision data provided. This is a genuine but moderate issue: the 7.1 rating is driven by the unauthenticated network vector, yet the mandatory user-interaction requirement and client-side-only Low impacts make it a lower real-world priority than the raw High score suggests - a real defect to patch, not an emergency.

An attacker crafts a malicious URL or web page targeting a vulnerable parameter in the Parsi Date plugin on a WordPress site and lures a visitor or administrator into loading it. Because the input is reflected without proper output encoding, attacker-supplied JavaScript executes in the victim's browser under the site's origin, enabling session/cookie theft, defacement, or actions in the victim's authenticated context. No public exploit code is identified at time of analysis, and successful exploitation requires the victim to interact with the crafted link.