UpSolution Core EUVD-2026-95613

Exploitation requires that a victim with an active session on the target WordPress site (the privilege level that makes the attack meaningful) click an attacker-crafted link whose unsanitized parameter is reflected into a page generated by the UpSolution Core plugin (versions up to and including 8.44). The limiting factors are mandatory victim user interaction (UI:R) - the payload does not fire against default page traffic - and the need to deliver the crafted URL via social engineering; the plugin itself must be installed and active on the site. No special non-default plugin configuration is indicated by the description, but the reflected nature means there is no persistence and each victim must be individually induced to click.

This is a reflected cross-site scripting (XSS) flaw in the UpSolution Core (us-core) WordPress plugin, reported by Patchstack. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) yields a 7.1 (High) score, driven largely by the scope change (S:C) that reflects script executing in the victim's browser context rather than the server. However, the UI:R requirement is the single most important risk-limiting signal: unlike stored XSS, a reflected flaw requires the attacker to socially engineer an authenticated or privileged victim into clicking a crafted link, so it cannot self-propagate or fire against default traffic. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so exploitation-probability and automatability signals are entirely absent - this is a notable gap. There is no public exploit identified at time of analysis. Overall this is a real but moderate-priority issue: it should be patched on exposed sites, but in the absence of KEV/POC/EPSS evidence it does not rise to emergency status and resembles the large volume of routine Patchstack-reported WordPress plugin XSS reports rather than an actively weaponized threat.

An attacker crafts a URL for a vulnerable UpSolution Core plugin endpoint containing a malicious script payload in an unsanitized parameter, then lures a logged-in WordPress user or administrator into clicking it (e.g., via phishing email or a link on an attacker-controlled page). When the victim's browser renders the reflected response, the script executes in the site's origin, potentially hijacking the session or performing actions as the victim. No public exploit code was identified at time of analysis, and successful exploitation depends on the victim interacting with the crafted link (UI:R).