Pin WP EUVD-2026-96490

Exploitation requires the attacker to trick an authenticated or unauthenticated user of a site running the an-themes Pin WP theme (version 7.0 or earlier) into clicking a specially crafted URL that reflects an unsanitized input parameter back into the page (reflected XSS, CWE-79). The attacker needs no credentials (PR:N), but the attack is gated by mandatory victim interaction (UI:R) - without the victim following the malicious link, the payload does not execute - and impact is maximized when the victim is a privileged user such as a site administrator. The limiting factors are: the requirement for active social engineering to deliver the link, the reflected (non-persistent) nature meaning no stored payload on the server, and applicability only to sites that have the vulnerable Pin WP theme installed and active.

This is a moderate-risk, not top-priority, vulnerability. The CVSS 3.1 score of 7.1 (vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-reachable, low-complexity, unauthenticated (PR:N) reflected XSS whose severity is inflated by the changed scope (S:C) typical of Patchstack's browser-context XSS scoring; the actual direct impact is only Low across confidentiality, integrity, and availability. The single most important mitigating signal is UI:R - exploitation requires a victim to be lured into clicking a crafted link, which makes this a targeted, social-engineering-dependent issue rather than a mass-exploitable server flaw. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, consistent with 'no public exploit identified at time of analysis.' Because this is a reflected (not stored) XSS in a niche WordPress theme, there is no evidence of widespread or automated exploitation. Key missing data to note explicitly: EPSS probability is absent, so statistical likelihood cannot be quantified; exact affected sub-versions beyond '<= 7.0' and the specific vulnerable parameter/endpoint are not disclosed in the description. Overall: a legitimate issue worth patching on affected sites, but not an emergency relative to higher-impact or actively-exploited CVEs.

An attacker crafts a malicious URL targeting the vulnerable Pin WP theme parameter and delivers it to a victim (e.g., a logged-in site administrator) via phishing email, chat, or a planted link. When the victim clicks it, the reflected payload executes JavaScript in their browser session in the site's context, enabling session/cookie theft, admin action forgery, or redirection. No public exploit code was identified at time of analysis, and success depends on the victim interacting with the attacker-supplied link (UI:R).