HTTP Requests Manager EUVD-2026-93246

Exploitation requires that a victim who is logged into a WordPress site running HTTP Requests Manager <= 1.3.11 interacts with attacker-controlled input - e.g. clicking a crafted link or loading an attacker-influenced page/parameter handled by the plugin (UI:R in the vector is the key limiting factor). No authentication is required of the attacker (PR:N), so the payload can be delivered by any remote party, but the script only fires in the context of the interacting user's session; maximum impact is realized when that user is a site administrator. Limiting factors: the target site must have this specific plugin installed and active at a vulnerable version, and a human must be socially engineered into triggering the payload - there is no unattended, fully automated server-side trigger.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1 HIGH) indicates a network-reachable, low-complexity, unauthenticated flaw whose scope-change (S:C) reflects XSS executing in the victim's browser context across a security boundary. The critical mitigating signal in the vector is UI:R - exploitation requires a victim (typically an authenticated admin or logged-in user) to be lured into triggering the payload, so this is not self-propagating or mass-automatable. No EPSS score, CISA KEV listing, or public POC was provided in the input; the only source is a single Patchstack advisory. Exploitation status is therefore: no public exploit identified at time of analysis. The 7.1 score is driven largely by the unauthenticated vector and scope change rather than by direct system compromise - the C:L/I:L/A:L impacts are the limited, browser-session-scoped effects typical of XSS, not server-side code execution. Net: a real, patchable vulnerability worth remediating on normal cycles, but the required user interaction and the niche plugin footprint make widespread opportunistic exploitation unlikely absent targeted social engineering.

An attacker crafts a malicious URL or injected payload targeting the HTTP Requests Manager plugin (<= 1.3.11) and lures a logged-in WordPress user - ideally an administrator - into clicking it or viewing attacker-controlled content. The script executes in the victim's authenticated browser session, enabling session/cookie theft, admin-action forgery, or injection of further malicious content. No public exploit code was identified, and successful exploitation hinges on the victim interacting with the attacker-supplied input (UI:R).