Bracketweb Treck Theme EUVD-2026-95758

Exploitation requires the Bracketweb Treck WordPress theme (version up to and including 1.0.0) to be installed and active, and requires a victim to click an attacker-crafted URL containing the payload in a reflected, unsanitized input parameter (UI:R). Because it is reflected (non-persistent) XSS, the payload is not stored server-side and must be delivered per-victim via social engineering; it does not fire on normal page visits. The practical impact is highest when the victim is an authenticated administrator, since the script then runs in the WordPress admin browser session. Limiting factors: mandatory user interaction, dependence on this specific theme being deployed, and the low real-world footprint of the theme.

This is a reflected cross-site scripting (XSS) flaw in the Bracketweb 'Treck' WordPress theme (affected through 1.0.0), rated CVSS 7.1. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L indicates a network-reachable, low-complexity issue requiring no attacker privileges but requiring victim interaction (UI:R), with a scope change (S:C) reflecting script execution in the victim's browser context outside the vulnerable component. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The elevated 7.1 score is driven largely by the scope change and the triple low impact (C:L/I:L/A:L), which is Patchstack's standard scoring pattern for reflected XSS rather than a signal of severe or automatable compromise. Realistically this is a moderate, interaction-dependent issue: it depends on social-engineering a logged-in user (typically an administrator) into clicking a crafted link, so it is a lower operational priority than an unauthenticated server-side RCE despite the 'High' label. The A:L (availability) impact is somewhat generous for a reflected XSS and should be treated with skepticism - reflected XSS rarely affects availability in practice.

An attacker crafts a URL for the affected Treck theme containing a malicious script payload in an unsanitized reflected parameter and delivers it to a victim (e.g., a site administrator) via email or a link. When the victim clicks the link while visiting the WordPress site, the payload reflects into the page and executes in their browser, allowing session/cookie theft or actions in the WordPress admin context. No public proof-of-concept is identified in the provided data, and successful exploitation requires the victim to click the attacker-supplied link (UI:R).