E-Commerce Pack EUVD-2026-93413

Exploitation requires an attacker to craft a request to a specific vulnerable E-Commerce Pack endpoint/parameter that reflects unsanitized user input into the generated web page, then induce a victim to open that crafted link (UI:R). Limiting factors: the attack is non-persistent (reflected), so it must be re-delivered per victim and cannot self-propagate; it depends on victim interaction (clicking/opening the link); and impact is confined to the victim's browser context (session/cookie theft, DOM manipulation) rather than direct server compromise. No authentication is required of the attacker (PR:N), and the exact vulnerable parameter is not specified in the available data. No vendor patch is available, so no fixed configuration mitigates it at this time.

This is a moderate-severity reflected XSS (CVSS 6.1) that should be treated as a low-to-moderate real-world priority rather than an urgent threat. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates a network-reachable, low-complexity, unauthenticated flaw, but the required user interaction (UI:R) and the reflected (non-persistent) nature substantially limit mass exploitation - each victim must be lured into clicking an attacker-crafted link. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The scope change (S:C) and limited confidentiality/integrity impact reflect typical browser-context compromise (session/cookie theft, UI manipulation) rather than server compromise. A notable risk-relevant gap: the vendor was contacted but did not respond, so no patch exists, leaving the issue unmitigated at the vendor level - this raises residual risk for deployed instances despite the modest severity. Overall this is a genuine but not high-priority issue, weighted down further by the apparently niche footprint of the product.

An attacker crafts a URL for a vulnerable E-Commerce Pack endpoint that reflects attacker-controlled input into the page without proper neutralization, embedding a JavaScript payload. The attacker delivers this link to a victim (e.g., a shopper or store administrator) via phishing or a malicious post; when the victim opens it, the script executes in their browser session, enabling session cookie theft, credential harvesting via fake forms, or actions performed as the victim. No public POC is identified in the provided data, and exploitation requires the victim to click the crafted link (UI:R).