Martfury WordPress Theme EUVD-2026-96398

Exploitation requires victim user interaction (CVSS UI:R): the target must open an attacker-crafted link or request that causes the Martfury theme to reflect unsanitized input back into a generated web page, so it is not a passive drive-by against the server. No authentication is required of the attacker (PR:N), and default configurations of the theme are affected across all versions up to and including 3.3.9. The limiting factors are the need to socially engineer a victim into triggering the reflected request and the fact that impact is confined to the victim's browser session and the theme's context rather than direct server-side compromise; the specific vulnerable parameter/endpoint is not disclosed in the provided data.

This is a reflected cross-site scripting (CWE-79) flaw in the Martfury WooCommerce Marketplace WordPress theme (≤3.3.9), carrying a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The score is elevated primarily by the scope change (S:C) inherent to XSS and the lack of required privileges (PR:N), but it is tempered by the mandatory user-interaction requirement (UI:R): an attacker cannot exploit this passively and must lure a victim into clicking or loading a crafted link. No EPSS score, CISA KEV listing, or SSVC decision data was supplied in the input, and no public exploit was referenced - so there is no public exploit identified at time of analysis. Reflected XSS in WordPress themes is a very common Patchstack finding and is real and patchable, but the combination of low per-vector impact (C:L/I:L/A:L - limited to the victim's session/browser context, not server compromise) and reliance on social engineering means this is a moderate, defense-in-depth priority rather than a drop-everything emergency. The absence of EPSS/KEV signals is an information gap, not evidence of safety; reflected XSS is cheap to weaponize for targeted phishing even without a published PoC.

An attacker crafts a malicious URL targeting a vulnerable Martfury theme endpoint that reflects unsanitized input into the page, then delivers it via phishing email, a malicious ad, or a forum post. When a logged-in administrator or shopper clicks the link, the injected JavaScript executes in their browser session, potentially stealing session cookies, performing actions on their behalf, or redirecting them. No public exploit code was referenced, so exploitation currently requires the attacker to construct the payload themselves.