Magee Shortcodes EUVD-2026-94185

Exploitation requires that the vulnerable Magee Shortcodes plugin (version 2.1.1 or earlier) be installed and active on a WordPress site, and that a victim with an active browser session be socially engineered into clicking an attacker-crafted link to one of the plugin's unauthenticated AJAX action endpoints. The specific trigger is unsanitised/unescaped user input in certain AJAX actions reflected back into the response. Key limiting factor: UI:R - this is reflected (not stored) XSS, so no payload persists on the server and each exploitation depends on victim interaction with a crafted request; impact magnitude (e.g., administrative takeover) depends on the privileges of the victim whose browser executes the payload. No authentication is required to reach the vulnerable endpoint (PR:N confirmed by CVSS vector).

This is a genuine but moderate-priority issue, not a critical emergency. The provided CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L = 7.1) shows network attack vector, low complexity, and no privileges required (PR:N confirms unauthenticated reach via the plugin's AJAX actions), which raises the score - but the UI:R requirement means a victim must click a crafted link for exploitation to succeed, substantially limiting automated/wormable mass exploitation. No EPSS score, no CISA KEV listing, and no SSVC decision data were provided; absence of these is not evidence of safety but means widespread-exploitation probability cannot be quantified from the input. Public exploit/PoC detail exists via WPScan, so exploitation is practically feasible for a motivated attacker, yet reflected (non-stored) XSS requiring user interaction is typically used in targeted social-engineering rather than broad opportunistic campaigns. One data inconsistency to verify: the input vector includes A:L (availability impact), which is atypical for reflected XSS - standard WPScan reflected-XSS scoring omits availability impact (yielding ~6.1), so the 7.1 appears slightly inflated; treat the severity as moderate.

An attacker crafts a malicious URL targeting one of the plugin's unauthenticated AJAX actions, embedding JavaScript in a parameter that the plugin reflects unescaped into the HTTP response. The attacker sends this link to a victim (e.g., a logged-in WordPress administrator) via phishing; when the victim clicks it, the script executes in their browser session in the site's origin, enabling session/cookie theft or actions on their behalf. A public PoC is available through WPScan, lowering the effort to reproduce.