KuteShop EUVD-2026-96502

Exploitation requires an attacker to deliver a crafted URL containing a malicious script payload to a victim who must then click it (UI:R / reflected XSS), so there is no fully automated or interaction-free attack path. The target site must be running the KuteShop WordPress theme at version 4.2.9 or earlier. No authentication is required of the attacker (PR:N), but impact depends on the privileges of the victim whose browser executes the payload - compromising an administrator session yields greater leverage than a visitor session. The need for user interaction and a specific vulnerable theme version are the primary limiting factors.

This is a reflected Cross-Site Scripting flaw (CWE-79) in the KuteShop WordPress theme at versions <= 4.2.9, reported by Patchstack with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The vector signals favorable exploitation conditions - network-reachable, low complexity, and no authentication (PR:N) - but the required user interaction (UI:R) materially lowers real-world risk, since a victim must be lured into clicking an attacker-crafted link. The scope change (S:C) reflects that injected script executes in the victim's browser context rather than affecting the server directly, and the Low/Low/Low impact ratings indicate limited per-incident damage (e.g., session/cookie theft or page manipulation) rather than full compromise. No EPSS probability, CISA KEV listing, POC, or SSVC decision data was provided in the input, so there is no signal of active or probable exploitation; the elevated 7.1 score is driven primarily by the unauthenticated network vector and scope change rather than by evidence of weaponization. The reference URL describes the issue as a 'reflected' XSS, while the summary description labels it 'Unauthenticated XSS' - these are consistent, and the reflected nature reinforces that exploitation hinges on social engineering. Overall this is a moderate-priority web vulnerability typical of WordPress theme findings, not a critical unauthenticated remote-code-execution emergency.

An attacker crafts a URL for a vulnerable KuteShop-powered WooCommerce/WordPress site that embeds malicious JavaScript into a reflected parameter, then delivers it to a logged-in store administrator or customer via phishing. When the victim clicks the link, the script executes in their browser session, enabling session cookie theft, credential harvesting, or actions performed as the victim. No public exploit identified at time of analysis, though the Patchstack database entry documents the vulnerability.