Scripts n Styles EUVD-2026-95727

Exploitable only against WordPress sites with the unFocus Projects Scripts n Styles plugin installed and active at version 3.5.8 or earlier. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and no special configuration are required to reach the vulnerable code path, so default installations of the affected plugin are exposed. The primary limiting factors are therefore the plugin's presence and version rather than any runtime prerequisite; impact is further bounded to low confidentiality exposure (C:L, with no integrity or availability impact), meaning a successful request discloses or reaches restricted functionality but does not grant data modification or site takeover. Exact affected sub-functionality is not detailed in the available advisory data.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3 Medium) indicates a network-reachable, low-complexity, unauthenticated flaw with only low confidentiality impact and no integrity or availability impact - consistent with a CWE-862 Missing Authorization issue that exposes limited data or functionality rather than enabling full compromise. No EPSS score was supplied, and the vulnerability is NOT listed in CISA KEV, so there is no public evidence of active exploitation. No proof-of-concept is referenced in the single Patchstack advisory provided. The one Tag labeled 'Authentication Bypass' overstates the vector slightly: the CWE (862 Missing Authorization) and the C:L/I:N/A:N impact point to a broken access-control / authorization gap affecting a specific function, not a full authentication bypass yielding privileged access. On balance this is a real-but-modest-priority issue: genuinely remote and unauthenticated, but low technical impact and hosted in a niche plugin, so it is more of a routine patch item than an emergency. Missing data to note explicitly: EPSS probability is absent, POC status is unknown, and exact affected-version boundaries rely solely on the vendor advisory and NVD CPE (through 3.5.8).

A remote, unauthenticated attacker sends a crafted HTTP request directly to a Scripts n Styles plugin endpoint whose authorization check is missing or misconfigured, invoking functionality or reading data that should require higher privileges. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing is needed, though impact is limited to low confidentiality exposure. No public proof-of-concept exploit is referenced in the available data.