ShopBuilder EUVD-2026-95602

Exploitation requires a victim with an active session (typically a logged-in store administrator or user) to click an attacker-crafted link, as reflected XSS has no persistent injection - this is the primary limiting factor (CVSS UI:R). No authentication is required of the attacker (PR:N), and the flaw is reachable remotely over the network against affected installs of ShopBuilder up to and including version 3.4.1. The CVE description does not name the specific vulnerable parameter, endpoint, or configuration, so defenders cannot scope a narrower precondition than 'the vulnerable ShopBuilder plugin is installed and active'; impact is magnified when the lured victim is a privileged admin.

This is a moderate-severity reflected XSS (CWE-79) in the ShopBuilder WordPress plugin, scored CVSS 7.1 via vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The network vector (AV:N), low complexity (AC:L), and no-privilege requirement (PR:N) make it reachable by unauthenticated remote attackers, but the mandatory user interaction (UI:R) is the key limiting factor: a victim must be lured into clicking a crafted link, so exploitation is per-target and social-engineering-dependent rather than wormable. The 7.1 score is inflated primarily by the scope change (S:C) that Patchstack conventionally applies to XSS; the actual impacts are only Low across confidentiality, integrity, and availability. No EPSS score, KEV listing, or POC was provided in the input - exploitation status is therefore 'no public exploit identified at time of analysis.' Net assessment: a real but not urgent issue. It is a credible threat to WooCommerce storefront operators and logged-in admins who can be phished, but it is not a mass-exploitation or high-priority emergency absent evidence of active exploitation. The absence of EPSS/KEV/POC data is a genuine gap, not confirmation of low risk - verify against the Patchstack advisory for any later exploitation signals.

An attacker crafts a malicious URL targeting a vulnerable ShopBuilder parameter and sends it to a store administrator or logged-in user via phishing email or a planted link. When the victim clicks it, the unsanitized input reflects into the page and executes attacker-controlled JavaScript in their browser session, enabling session-token theft, admin-action forgery, or redirection. No public exploit code was identified at the time of analysis, so weaponization would require an attacker to develop the payload from the vulnerability details.