What is the CVSS score of CVE-2026-27348?

CVE-2026-27348 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of ThemeGoods Photography are affected by CVE-2026-27348?

A cross-site scripting vulnerability in ThemeGoods Photography plugin (versions up to 7.6.1) could allow attackers to inject malicious scripts that execute in users' browsers, potentially…

How to fix or mitigate CVE-2026-27348?

Within 24 hours: Inventory all instances of ThemeGoods Photography plugin and document affected versions; assess whether the vulnerable input vectors are exposed to untrusted user input. Within 7 days: Implement WAF rules to detect and block XSS payloads targeting the plugin; consider disabling the plugin if not business-critical or moving it behind authentication. Within 30 days: Establish a contact channel with ThemeGoods for patch availability; evaluate alternative photography plugins; plan controlled re-enablement once patches are available.

ThemeGoods Photography CVE-2026-27348

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-05 audit@patchstack.com

XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Photography photography allows DOM-Based XSS.This issue affects Photography: from n/a through <= 7.6.1.

AnalysisAI

DOM-based cross-site scripting in ThemeGoods Photography plugin version 7.6.1 and earlier enables attackers to inject malicious scripts that execute in users' browsers without authentication, potentially compromising sensitive data or session tokens. The vulnerability requires user interaction to trigger and has network-wide impact, affecting any website running the affected Photography plugin version.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects ThemeGoods Photography photography. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Photography photography allows DOM-Based XSS.This issue affects Photography: from n/a through <= 7.6.1.

Affected ProductsAI

Product: ThemeGoods Photography photography.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.