What is the CVSS score of CVE-2026-27425?

CVE-2026-27425 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Automotive Listings are affected by CVE-2026-27425?

The Automotive Listings WordPress plugin (versions 18.6 and earlier) contains a reflected cross-site scripting vulnerability allowing unauthenticated attackers to inject malicious scripts into…

How to fix or mitigate CVE-2026-27425?

Within 24 hours: Inventory all WordPress instances running Automotive Listings plugin versions 18.6 or earlier. Within 7 days: Disable the plugin, deploy Web Application Firewall rules to block reflected XSS payloads, and implement Content Security Policy headers. Within 30 days: Replace the plugin with a verified secure alternative or re-enable only after monitoring Patchstack and vendor advisories for a released patch and upgrading to the fixed version.

Automotive Listings CVE-2026-27425

EUVD-2026-41334 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-jcxf-hgc5-3v4w

WordPress XSS Wordpress Plugin Automotive Listings Themesuite

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network-reachable reflected XSS (PR:N, AV:N) needing victim click (UI:R); browser-context execution changes scope (S:C) with low C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:10 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Automotive Listings <= 18.6 versions.

AnalysisAI

Reflected Cross-Site Scripting in the Automotive Listings WordPress plugin (versions 18.6 and earlier) lets remote unauthenticated attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Reported by Patchstack and classified CWE-79 with a CVSS 3.1 score of 7.1 (scope-changed, low impact across confidentiality, integrity, and availability), the flaw requires user interaction but no authentication. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected component is Automotive Listings, a WordPress plugin (CPE cpe:2.3:a:themesuite:automotive_listings) published by ThemeSuite and used to build vehicle/dealer listing sites on WordPress. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the reflected variant: user-supplied request parameters are echoed back into an HTTP response without adequate output encoding or input sanitization, so a browser interprets attacker-controlled markup as executable script. Because this is reflected rather than stored, the malicious payload is delivered per-request via a crafted URL rather than being persisted server-side.

RemediationAI

No vendor-released patch version is identified in the available data, so the primary action is to consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/automotive/vulnerability/wordpress-automotive-listings-plugin-18-6-reflected-cross-site-scripting-xss-vulnerability) and upgrade to any release later than 18.6 once published by ThemeSuite. As compensating controls until a fixed version is confirmed, deploy a WordPress-aware Web Application Firewall (such as Patchstack's own virtual patch or equivalent WAF rules) to filter XSS payloads in request parameters - noting this can produce false positives on legitimate rich input; alternatively, if the plugin is non-essential, deactivate and remove it to eliminate exposure entirely, at the cost of losing listing functionality. Because exploitation requires a victim to click a crafted link, user awareness of suspicious URLs and restricting who can access affected pages further reduce practical risk.