What is the CVSS score of CVE-2026-27402?

CVE-2026-27402 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Kids Life Theme are affected by CVE-2026-27402?

The DesignThemes 'Kids Life | Children School' WordPress theme (versions 5.2 and earlier) contains a reflected and stored XSS vulnerability exploitable by unauthenticated remote attackers.

How to fix or mitigate CVE-2026-27402?

Within 24 hours: Inventory all WordPress instances using DesignThemes 'Kids Life | Children School' theme, versions 5.2 and earlier. Within 7 days: Deactivate and replace the vulnerable theme with a secure, actively maintained alternative; if immediate replacement is not feasible, deploy Web Application Firewall (WAF) rules to block script injection payloads in HTTP parameters. Within 30 days: Confirm all affected instances have been migrated to a secure alternative theme and review security logs for exploitation attempts.

Kids Life Theme CVE-2026-27402

EUVD-2026-41328 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-7rxg-r73h-jq37

WordPress XSS Kids Life Children School Wordpress Wordpress Theme Designthemes

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable unauthenticated XSS requiring victim interaction (UI:R) with scope change into the browser context and limited low-impact script effects, matching typical reflected theme XSS.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:08 vuln.today

CVE Published

Jul 02, 2026 - 11:14 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions.

AnalysisAI

Reflected/stored cross-site scripting in the DesignThemes 'Kids Life | Children School' WordPress theme (versions 5.2 and earlier) allows unauthenticated remote attackers to inject arbitrary web script that executes in a victim's browser when they interact with a crafted link or input. The CVSS vector (PR:N, UI:R, Scope Changed) indicates no authentication is needed but the victim must be lured into interaction, and the injected script can cross into other security contexts. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected component is a commercial WordPress theme (CPE cpe:2.3:a:designthemes:kids_life_|_children_school_wordpress) built by DesignThemes, typically deployed on school/education-oriented WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied data is rendered into HTML output without adequate sanitization or context-aware output encoding. In WordPress themes this class of flaw commonly arises in template files, shortcodes, or query-parameter handlers that echo request data (e.g. search terms, GET parameters, form fields) directly into the page. The 'Scope: Changed' (S:C) element in the CVSS vector reflects XSS crossing the trust boundary from the vulnerable page into the browser's execution context for the site.

RemediationAI

No fixed version number is specified in the provided data, so treat this as 'Patch available per vendor advisory' and consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/kidslife/vulnerability/wordpress-kids-life-children-school-wordpress-theme-5-2-cross-site-scripting-xss-vulnerability) and the DesignThemes changelog for a release above 5.2, upgrading to it once confirmed. Until a patched theme version is verified, apply a WAF or WordPress virtual-patching rule (Patchstack itself offers this) to filter XSS payloads reaching the vulnerable theme endpoints; the trade-off is potential false positives on legitimate rich input. As additional compensating controls, deploy a strict Content-Security-Policy header to limit inline script execution (may break theme features that rely on inline JS), and restrict/monitor the specific request parameters the theme reflects. Avoid clicking untrusted links pointing at affected sites, and audit for any injected script in stored content.