SpabRice Pond EUVD-2026-95787

Exploitation requires an attacker to deliver a specially crafted URL containing a script payload to a victim and have that victim open it in a browser (UI:R), causing the Pond theme to reflect the unsanitized input back into the generated page. No authentication is required of the attacker (PR:N), but the attack is LIMITED by mandatory user interaction (victim must click the malicious link) and by the reflected (non-persistent) nature of the flaw, which means it cannot be triggered without active social engineering and does not persist on the server. Highest impact is realized when the lured victim is an authenticated administrator, as the script then runs in that privileged browser context. Affected scope: any site running the SpabRice Pond theme up to and including version 2.6.1.

This is a reflected cross-site scripting (CWE-79) flaw in the SpabRice 'Pond' WordPress theme. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1 High) indicates a network-reachable, low-complexity, unauthenticated attack that nonetheless REQUIRES user interaction (UI:R) and carries only Low confidentiality, integrity, and availability impact with a changed scope (S:C, reflecting payload execution in the victim's browser outside the vulnerable component). No EPSS score, KEV listing, or public POC was supplied with this intelligence, so exploitation likelihood cannot be quantified from the data and there is no public exploit identified at time of analysis. Realistically this is a classic reflected-XSS issue: the 7.1 base score overstates practical priority because successful attacks hinge on social-engineering a victim into clicking a crafted link, and reflected XSS is not self-propagating. Treat it as a standard-priority patch item (session/credential theft, admin-targeted phishing) rather than an urgent mass-exploitation threat, especially given the niche deployment footprint of this theme. Note: the absence of EPSS/KEV/POC is a data gap, not evidence of safety.

An attacker crafts a URL for a Pond-powered WordPress site containing a malicious script in a parameter that the theme reflects unsanitized into the page. The attacker sends this link to a site administrator or logged-in user via phishing; when the victim clicks it, the script executes in their browser session, enabling session-cookie theft or actions in their authenticated context. No public exploit code was provided in this intelligence, and the attack depends on the victim's interaction (UI:R).