Zeinet Theme EUVD-2026-96291

Exploitation requires an attacker to deliver a crafted URL and a victim to actively click it (CVSS UI:R) while visiting a site running the Zeinet theme version 1.0.0 or earlier; the injected input is reflected unsanitized into the generated web page. No authentication is required of the attacker (PR:N), but the mandatory user-interaction step is the primary limiting factor - there is no autonomous or drive-by path. Impact is amplified if the clicking victim is an authenticated administrator, enabling session hijacking or actions in that privileged context. The specific vulnerable parameter is not disclosed in the available data.

This is a moderate-severity reflected cross-site scripting flaw (CVSS 7.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C) in the Zeinet WordPress theme by Bracketweb, affecting all versions up to and including 1.0.0. The CVSS vector indicates network-reachable, low-complexity, unauthenticated exploitation but with required user interaction (UI:R) and a scope change (S:C) reflecting that the injected script executes in the victim's browser rather than the server. No EPSS score was supplied in the input, there is no CISA KEV listing, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The UI:R requirement materially lowers real-world risk versus a drive-by server-side flaw: an attacker must lure a victim into clicking a crafted link. The 7.1 score is driven largely by the scope change plus Patchstack's assignment of low confidentiality, integrity, AND availability impact; in practice reflected XSS rarely yields genuine availability impact, so the effective impact is likely narrower than the headline score suggests. Net assessment: a credible but not urgent issue - patch in normal cycles rather than as an emergency, barring new exploitation signals.

An attacker crafts a malicious URL targeting a vulnerable reflected-input parameter on a site running the Zeinet theme (≤1.0.0) and delivers it via phishing email, social media, or a malicious ad. When a logged-in administrator or other user clicks the link, the unsanitized payload reflects back into the generated page and executes JavaScript in their browser session, potentially stealing session cookies or performing actions as that user. No public exploit code is referenced in the available data.