What is the CVSS score of CVE-2026-27408?

CVE-2026-27408 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of NativeChurch are affected by CVE-2026-27408?

The NativeChurch WordPress theme (versions 4.8.8.2 and earlier) contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary…

How to fix or mitigate CVE-2026-27408?

Within 24 hours: Inventory WordPress instances running NativeChurch theme versions 4.8.8.2 or earlier and document user-facing sites. Within 7 days: Deploy WAF rules to block XSS payloads targeting this theme; implement or strengthen Content Security Policy headers; enable logging on affected web applications. Within 30 days: Migrate to an alternative theme or replace with patched version upon vendor release; monitor imithemes advisory channels for updates.

NativeChurch CVE-2026-27408

EUVD-2026-41330 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-49cj-8cwx-rw82

XSS Nativechurch WordPress Wordpress Theme

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated reflected XSS (PR:N) needing victim click (UI:R) with browser-context scope change (S:C); low C/I but no genuine availability impact, so A:N.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:09 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in NativeChurch <= 4.8.8.2 versions.

AnalysisAI

Reflected cross-site scripting in the NativeChurch WordPress theme (versions 4.8.8.2 and earlier, by imithemes) allows unauthenticated attackers to inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 vector (7.1) reflects a scope change with limited confidentiality, integrity, and availability impact, and requires victim interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was disclosed through Patchstack's WordPress vulnerability database.

Technical ContextAI

NativeChurch is a commercial WordPress theme distributed by imithemes (identified by the CPE cpe:2.3:a:imithemes:nativechurch), targeted at church and religious organization websites. The flaw is a CWE-79 improper neutralization of input during web page generation: user-controllable input is reflected back into an HTTP response without adequate output encoding or input sanitization, so an attacker-supplied value is rendered as executable markup in the page. Because this is a reflected (non-persistent) variant, the malicious payload is delivered via the request itself - typically a URL parameter handled by a theme template or endpoint - rather than being stored server-side.

RemediationAI

Upgrade the NativeChurch theme to a release newer than 4.8.8.2 once imithemes publishes a fixed version; the input data does not specify an exact patched version, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/nativechurch/vulnerability/wordpress-nativechurch-theme-4-8-8-2-reflected-cross-site-scripting-xss-vulnerability) and the imithemes vendor page to confirm the target version before upgrading. Until a fix is applied, deploy a web application firewall or WordPress virtual-patching rule (Patchstack itself offers this) to filter XSS payloads on the vulnerable parameter - the trade-off is potential false positives on legitimate rich input. As additional compensating controls, restrict access to the affected theme endpoint or disable the vulnerable theme feature if it is not needed, and educate administrators to avoid clicking untrusted links to the site since exploitation depends on victim interaction.