NativeChurch CVE-2026-27408

Exploitation requires a site running the NativeChurch theme at version 4.8.8.2 or earlier, and - per CVSS UI:R - the attacker must convince a victim to click or load a specially crafted URL containing the XSS payload; it cannot be triggered unattended against the server. No authentication is required to send the payload (PR:N), but impact is greatest when the victim is an authenticated administrator whose session the script can abuse. The limiting factors are the mandatory user interaction and the requirement that the specific vulnerable theme (not just WordPress) be installed and reachable.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1 High) indicates network-reachable, low-complexity, unauthenticated exploitation, but crucially requires user interaction (UI:R) - the victim must click or load a malicious link, which meaningfully limits mass exploitation. The scope change (S:C) reflects XSS crossing from the application into the victim's browser context, justifying the elevated score. No EPSS score, KEV listing, or POC was provided in the intelligence, so there is no evidence of active exploitation or a published exploit; the low individual C/I/A ratings are consistent with typical reflected XSS impact (session/UI manipulation rather than full compromise). Realistically this is a moderate-priority issue: dangerous in phishing/social-engineering chains, especially against authenticated administrators, but not a wormable or unattended-exploitation threat. The A:L (availability) rating is somewhat generous for reflected XSS and should be treated with mild skepticism - verify against the vendor advisory.

An attacker crafts a URL to the target NativeChurch-powered site with a malicious script payload embedded in a reflected parameter and delivers it to a logged-in administrator via email or a forum post. When the victim opens the link, the injected JavaScript executes in their authenticated browser session, allowing the attacker to steal session cookies, perform actions as the admin, or redirect the user. No public POC was provided, but reflected XSS of this class is straightforward to weaponize once the vulnerable parameter is identified.