What is the CVSS score of CVE-2026-27367?

CVE-2026-27367 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of ThemeGoods Musico are affected by CVE-2026-27367?

A reflected cross-site scripting (XSS) vulnerability in ThemeGoods Musico theme (versions 3.2.4 and earlier) could allow attackers to inject malicious scripts that execute in users' browsers,…

How to fix or mitigate CVE-2026-27367?

Within 24 hours: Identify all instances of Musico theme in use and assess customer-facing exposure; notify affected stakeholders. Within 7 days: Implement compensating controls (WAF rules to detect XSS payloads, input validation enforcement, Content Security Policy headers); disable user input features if possible; consider migrating to alternative theme if critical. Within 30 days: Monitor vendor for patch release and apply immediately upon availability; conduct security audit of affected systems; implement user awareness training on phishing/XSS attacks.

ThemeGoods Musico CVE-2026-27367

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-05 audit@patchstack.com

XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Musico musico allows Reflected XSS.This issue affects Musico: from n/a through <= 3.2.4.

AnalysisAI

Reflected cross-site scripting in ThemeGoods Musico through version 3.2.4 enables attackers to inject malicious scripts into web pages viewed by users, potentially compromising session data and user credentials. The vulnerability requires user interaction to trigger and affects all installations of the affected Musico versions, with no patch currently available.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects ThemeGoods Musico musico. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Musico musico allows Reflected XSS.This issue affects Musico: from n/a through <= 3.2.4.

Affected ProductsAI

Product: ThemeGoods Musico musico.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.