StoreGrowth Sales Booster EUVD-2026-93259

Exploitation requires a victim with an active session to click a crafted link or load attacker-influenced input (UI:R), causing the XSS payload to render in the StoreGrowth 'Smart Sales Booster for WooCommerce' plugin at versions <= 2.0.6 on a WordPress/WooCommerce site. No authentication is required of the attacker (PR:N), but the dependency on user interaction and a running WordPress site with this specific plugin installed and active limits realistic exploitation; impact is confined to the victim's browser context (client-side), not direct server compromise. The precise vulnerable parameter is not named in the available data.

This is a moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1 HIGH) describes a network-reachable, low-complexity, unauthenticated reflected/stored-style Cross-Site Scripting flaw that requires victim user interaction (UI:R) and carries only Low impact across confidentiality, integrity, and availability, with a changed scope reflecting script execution in the victim's browser context rather than on the server itself. No EPSS score, KEV listing, or POC indicator was supplied in the input, so exploitation likelihood cannot be quantified from the available data; per precision rules, there is no public exploit identified at time of analysis and this is NOT confirmed as actively exploited. The signals are internally consistent - a 7.1 driven mostly by the scope change and network vector, tempered by the UI:R requirement and uniformly Low impacts - so this is best read as a genuine but not critical web-application XSS typical of WordPress plugin advisories, rather than a wormable or server-compromising flaw. The practical risk is bounded by the need to lure an authenticated administrator or user into triggering the payload.

An attacker crafts a malicious URL or input containing a JavaScript payload targeting a vulnerable parameter in the StoreGrowth plugin (<= 2.0.6) and tricks a site user or administrator into visiting it (UI:R). When the page renders the unsanitized input, the script executes in the victim's browser session, potentially stealing session cookies, performing actions as the victim, or defacing content. No public proof-of-concept was provided in the input data.