What is the CVSS score of CVE-2026-24949?

CVE-2026-24949 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of ThemeGoods PhotoMe are affected by CVE-2026-24949?

A cross-site scripting vulnerability in ThemeGoods PhotoMe (versions up to 5.7.1) allows attackers to inject malicious code that executes in users' browsers, potentially compromising user accounts…

How to fix or mitigate CVE-2026-24949?

Within 24 hours: Inventory all installations of PhotoMe plugin and disable the application if not business-critical. Within 7 days: Implement Web Application Firewall (WAF) rules to block DOM-based XSS payloads targeting PhotoMe endpoints, and restrict plugin access to trusted internal networks only. Within 30 days: Contact ThemeGoods for security guidance, evaluate alternative plugins, and plan migration away from PhotoMe or await vendor patch availability.

ThemeGoods PhotoMe CVE-2026-24949

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-20 audit@patchstack.com

XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

CVE Published

Feb 20, 2026 - 16:22 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods PhotoMe photome allows DOM-Based XSS.This issue affects PhotoMe: from n/a through <= 5.7.1.

AnalysisAI

DOM-based cross-site scripting in ThemeGoods PhotoMe through version 5.7.1 enables attackers to inject malicious scripts that execute in users' browsers without authentication. An attacker can exploit this vulnerability to steal sensitive data, hijack user sessions, or perform unauthorized actions on behalf of affected users. No patch is currently available, and exploitation requires user interaction to trigger the payload.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects ThemeGoods PhotoMe photome. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods PhotoMe photome allows DOM-Based XSS.This issue affects PhotoMe: from n/a through <= 5.7.1.

Affected ProductsAI

Product: ThemeGoods PhotoMe photome.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.