Darna Framework CVE-2026-27088

Remote unauthenticated attacker crafts malicious URL containing XSS payload and tricks victim into clicking it. Affects G5Theme Darna Framework versions up to 2.9. Victim must click the malicious link in their browser.

Without a published CVSS score or EPSS metric, real-world risk assessment relies on available indicators: the vulnerability is classified as reflected XSS (CWE-79), suggesting network-based attack vector requiring user interaction (clicking a malicious link). The Patchstack reporting and ENISA EUVD-2026-15800 registration indicate formal disclosure and tracking, but the lack of KEV (Known Exploited Vulnerability) status and no mention of active exploitation suggest it is not yet weaponized at scale. The absence of a published POC limits immediate attack feasibility for script-kiddie-level actors. However, reflected XSS in a widely-used WordPress framework is highly automatable for skilled attackers and carries significant technical impact (session hijacking, credential theft). The real risk depends on plugin adoption rates and user behavior; this should be treated as moderate-to-high priority for affected organizations, particularly those with sensitive WordPress deployments.

An attacker crafts a malicious URL containing JavaScript payload in a vulnerable parameter (e.g., http://vulnerable-site.com/?search=<script>fetch('/admin?action=steal_token')</script>) and distributes it via phishing email or social media. When an authenticated WordPress user or administrator visits the link, the injected script executes in their browser with their session privileges, allowing the attacker to steal cookies, capture credentials, or trigger administrative actions. Since this is reflected XSS with no apparent stored component, the attack requires user interaction but is trivial to automate for credential harvesting campaigns targeting WordPress sites.