What is the CVSS score of CVE-2026-27430?

CVE-2026-27430 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of TheFox are affected by CVE-2026-27430?

The TheFox WordPress theme (versions 3.9.76 and earlier) contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious code into user browsers via…

How to fix or mitigate CVE-2026-27430?

Within 24 hours: Inventory all WordPress installations using TheFox theme and document current versions. Within 7 days: Configure Web Application Firewall (WAF) rules to filter JavaScript injection patterns; disable TheFox on non-critical sites if patch unavailable; notify users not to click links from untrusted sources. Within 30 days: Upgrade to patched version upon vendor release or migrate to alternative theme; verify WAF rules are logging attempted exploits.

TheFox CVE-2026-27430

EUVD-2026-41336 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-2qwh-3hfv-wj79

WordPress XSS Thefox Wordpress Theme

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated network reflected XSS needing victim click (PR:N/UI:R), script runs in browser context (S:C) with limited confidentiality/integrity impact and no real availability effect (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:12 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions.

AnalysisAI

Reflected cross-site scripting in the TheFox WordPress theme (versions 3.9.76 and earlier) lets an unauthenticated remote attacker inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Reported through Patchstack and scoped to the ThemeForest 'tranmautritam:thefox' theme, the flaw carries a CVSS 3.1 base score of 7.1 driven largely by a changed scope. There is no public exploit identified at time of analysis and no CISA KEV listing, so risk hinges on tricking a user into clicking a malicious URL.

Technical ContextAI

The affected component is TheFox, a commercial multipurpose WordPress theme published by tranmautritam (CPE cpe:2.3:a:tranmautritam:thefox:*). The root cause is CWE-79 (improper neutralization of input during web page generation): a request parameter is reflected back into an HTML response without proper output encoding or input sanitization, so attacker-supplied markup is rendered as active script by the browser. Because WordPress themes handle front-end rendering of user-influenced query parameters, an unsanitized echo of such a parameter is the classic reflected-XSS pattern seen repeatedly in ThemeForest/premium themes.

RemediationAI

No vendor-released patch version was identified in the provided data, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/thefox/vulnerability/wordpress-thefox-theme-3-9-76-reflected-cross-site-scripting-xss-vulnerability) and the ThemeForest product page for a release above 3.9.76 and upgrade to it once confirmed. Until a fixed version is verified, apply a Web Application Firewall rule (Patchstack, Wordfence, or ModSecurity) to block reflected XSS payloads targeting the theme's request parameters, which adds latency and may false-positive on legitimate rich input; restrict or monitor access to the affected theme endpoints and instruct administrators not to click untrusted links to the site; and consider setting a strict Content-Security-Policy that disallows inline script, accepting that a tight CSP can break theme functionality that relies on inline JavaScript.