WPLMS WordPress Theme EUVD-2026-93245

Exploitation requires victim user interaction: the attacker must lure a target into clicking a crafted URL or visiting a malicious page that triggers the reflected payload against a WPLMS site running version 4.972 or earlier (UI:R in the CVSS vector). No authentication is required of the attacker (PR:N), and the vulnerability is reachable remotely over the network against default installations, but the reliance on a victim clicking an attacker-supplied link is the primary limiting factor. Impact is maximized if the victim is an authenticated administrator, as the executed script runs in their privileged browser session; the specific vulnerable input parameter is not disclosed in the available data.

This is a moderate-severity reflected Cross-Site Scripting flaw (CVSS 7.1) in the WPLMS WordPress theme at versions <= 4.972. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L indicates network-based, low-complexity, unauthenticated exploitation, but critically requires user interaction (UI:R) - a victim must click a crafted link or visit an attacker-controlled page. The scope change (S:C) reflects XSS executing in the victim's browser context, affecting a component beyond the vulnerable one. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or automated weaponization - this is a real but not emergency-tier issue. The signals are consistent rather than conflicting: a reflected XSS that needs UI:R is typically used in targeted social-engineering rather than mass exploitation, so prioritize patching on externally reachable WPLMS sites but treat it below unauthenticated RCE or KEV-listed threats. Note the absence of EPSS/KEV/POC is a gap, not a contradiction; it simply means no exploitation telemetry is available at analysis time.

An attacker crafts a malicious URL targeting the vulnerable WPLMS parameter and delivers it to a victim via phishing email, forum post, or malicious link. When the victim (potentially an administrator or logged-in user) clicks the link, unsanitized input is reflected into the page and arbitrary JavaScript executes in their browser session. No public exploit code is identified at time of analysis, but reflected XSS of this type is straightforward to construct given the low attack complexity.