Parallax Section Block EUVD-2026-90844

Requires the bplugins 'Parallax Section' WordPress plugin version 2.0.4 or earlier to be installed and active, and the vulnerable Parallax Section block to render attacker-controlled input. Exploitation needs no authentication (PR:N) but does require victim user interaction (UI:R) - a user must load or interact with the page containing the injected payload for the script to execute. Impact is limited to the victim's browser context (S:C), not direct server compromise. Limiting factors: the plugin must be installed, the attacker must get the payload into a block field that reaches other users, and a victim must view that content.

Risk is moderate and heavily gated by user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L = 7.1) describes an unauthenticated (PR:N) network-reachable Cross-Site Scripting flaw whose execution depends on a victim loading or interacting with attacker-tainted content (UI:R), with a scope change (S:C) reflecting script execution in the victim's browser context rather than the server. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the 7.1 is a 'potentially serious but not confirmed-urgent' rating rather than a widespread-exploitation signal. The low confidentiality/integrity/availability sub-scores (C:L/I:L/A:L) are consistent with typical XSS impact (session/token theft, limited DOM manipulation) rather than server compromise; I would argue A:L is generous for XSS and lean toward A:N. Net: a real but not top-priority issue, most relevant where the plugin is installed and the affected block renders unsanitized input to other users.

An unauthenticated attacker crafts a malicious payload injected via the Parallax Section block's unsanitized input and gets it rendered on a page an administrator or visitor views. When the victim loads the affected page or interacts with the crafted element, the script executes in their browser, enabling session/cookie theft or actions in their authenticated context. No public PoC is known, and the attack requires the victim to view the tainted content (UI:R).