Ambed WordPress Theme EUVD-2026-96479

Exploitation requires an attacker to deliver a crafted link reflecting unsanitized input through the Ambed WordPress theme (version 1.0.0 or earlier) and to convince a victim - typically a logged-in administrator or site visitor - to click it (UI:R in the CVSS vector). No authentication is needed to craft or send the payload (PR:N), but the attack cannot succeed without that victim interaction, and it is limited to sites actually running the Ambed theme at <=1.0.0; sites on a patched version or a different theme are not affected. The reflected (non-persistent) nature means the payload must be freshly delivered to each victim rather than stored on the server.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) describes a network-reachable, low-complexity reflected XSS requiring no privileges but mandating user interaction (UI:R), with a changed scope (S:C) reflecting that injected script executes in the victim's browser context rather than the vulnerable component itself. Impact is uniformly Low across C/I/A, consistent with reflected XSS rather than a server-side code-execution flaw, which is why the score lands at 7.1 (High) rather than Critical. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis' - there is no signal of active or probable near-term exploitation. The practical bar is meaningful: an attacker cannot act autonomously but must lure an authenticated administrator or visitor into clicking a crafted link, so despite the 'unauthenticated' injection vector the attack is social-engineering-dependent. Net assessment: a legitimate High-severity web flaw worth patching, but its real-world risk is moderated by the UI:R requirement, the low deployment footprint of this specific theme, and the absence of any exploitation evidence - treat as routine prioritization, not an emergency.

An attacker crafts a URL for a vulnerable Ambed theme endpoint that reflects attacker-controlled input into the page without sanitization, then delivers it via phishing email or a malicious link to a site administrator or visitor. When the victim clicks the link, the injected JavaScript executes in their browser session in the context of the WordPress site, enabling session/cookie theft or actions on their behalf. No public exploit code was identified, and successful exploitation depends on the victim opening the attacker's link (UI:R).