What is the CVSS score of CVE-2026-27426?

CVE-2026-27426 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Automotive Car Dealership Business are affected by CVE-2026-27426?

The Automotive Car Dealership Business WordPress theme by ThemeSuite (versions 13.3.3 and earlier) contains a reflected cross-site scripting vulnerability allowing unauthenticated attackers to inject…

How to fix or mitigate CVE-2026-27426?

Within 24 hours: Inventory all sites using this theme and affected versions; enable WAF rules to block reflected XSS patterns; enable security monitoring for exploitation attempts. Within 7 days: Evaluate available upgrades to this theme's newer versions, or migrate to an alternative maintained WordPress theme with comparable features. Within 30 days: Complete transition away from this vulnerable theme to a vendor-supported alternative, as no vendor-released patch identified at time of analysis.

Automotive Car Dealership Business CVE-2026-27426

EUVD-2026-41335 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-8mfc-35rc-44rh

XSS Automotive Car Dealership Business WordPress Wordpress Theme

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated reflected XSS (PR:N) exploitable over the network (AV:N) but needing victim click (UI:R), executing in a different origin's context (S:C) with limited script-level impact (C/I/A:L).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:11 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business <= 13.3.3 versions.

AnalysisAI

Reflected cross-site scripting in the Automotive Car Dealership Business WordPress theme (versions 13.3.3 and earlier by ThemeSuite) lets unauthenticated attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 vector (AV:N/PR:N/UI:R/S:C) confirms network-based, unauthenticated exploitation that requires user interaction and crosses a security scope boundary. There is no public exploit identified at time of analysis and the flaw is not on CISA KEV.

Technical ContextAI

The affected component is a commercial WordPress theme (cpe:2.3:a:themesuite:automotive_car_dealership_business) targeted at car dealership websites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input is reflected back into an HTML response without proper output encoding or input sanitization. As a reflected XSS (per the Patchstack advisory title), the malicious payload is not stored server-side but delivered within the request itself - typically via a URL parameter - and echoed into the page, causing the browser to execute it in the context of the vulnerable site's origin.

RemediationAI

No vendor-released patch version is identified in the available data; the input confirms only that versions <= 13.3.3 are vulnerable. Consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/automotive/vulnerability/wordpress-automotive-car-dealership-business-theme-13-3-3-reflected-cross-site-scripting-xss-vulnerability) for a fixed release and upgrade to it once published. As compensating controls until a fix is applied, deploy a WordPress WAF (such as Patchstack or equivalent) with XSS rules to filter reflected payloads, which may cause false positives on legitimate query strings; and set a restrictive Content-Security-Policy header to block inline/injected script execution, noting this can break theme features that rely on inline JavaScript and requires testing. If the theme is not essential, switching to a maintained theme eliminates the exposure entirely.