CVE-2026-27348: 
WordPress vulnerability analysis and mitigation

CVE-2026-27348 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the ThemeGoods Photography WordPress theme. It affects Photography theme versions prior to 7.7.6 (with the EUVD entry noting versions up to and including 7.6.1 as vulnerable). The vulnerability was reported on February 25, 2026, by researcher Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity, and published on March 5, 2026. It carries a CVSS v3.1 base score of 7.1 (Medium/High) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically manifesting as DOM-Based XSS (CAPEC-588). The flaw arises from insufficient sanitization of user-supplied input that is written directly into the DOM via JavaScript, without proper encoding or validation. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction — a victim must visit or interact with a crafted page or link. No detailed technical write-up or public PoC code has been identified beyond the Patchstack advisory (Patchstack).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, redirection to malicious sites, defacement, or delivery of malware to site visitors. The scope is changed (affecting users beyond the vulnerable component), with low confidentiality, integrity, and availability impacts per the CVSS scoring (Patchstack, Red Hat CVE).

No evidence of active in-the-wild exploitation or inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog has been identified. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. No exploit kits or threat actor attribution have been reported. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites using the ThemeGoods Photography theme version below 7.7.6 using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/themes/photography).
2. Identify vulnerable DOM sink: Analyze the theme's JavaScript files to locate DOM-based XSS sinks where unsanitized user-controlled input (e.g., URL parameters or fragment identifiers) is written to the DOM via innerHTML, document.write, or similar methods.
3. Craft malicious payload: Construct a URL containing a JavaScript payload in the vulnerable parameter, such as https://victim-site.com/?param=<script>malicious_code</script> or using a hash-based vector like https://victim-site.com/#<img src=x onerror=alert(1)>.
4. Deliver to victim: Send the crafted URL to a target user via phishing email, social engineering, or embed it in a third-party page to trigger the victim's browser to load it.
5. Achieve objective: When the victim visits the crafted URL, the injected script executes in their browser context, enabling session token theft, credential harvesting, or redirection to attacker-controlled infrastructure (Patchstack).

• Network: Unusual outbound requests from victim browsers to attacker-controlled domains following visits to Photography-themed WordPress pages; referrer headers pointing to crafted URLs with encoded JavaScript payloads in query strings or URL fragments.
• Logs: WordPress access logs showing requests to theme pages with suspicious URL-encoded characters (%3Cscript%3E, %3Cimg, onerror=, javascript:) in query parameters or fragment identifiers.
• Browser/Client-Side: Unexpected JavaScript execution or redirects reported by users visiting the affected site; browser console errors related to cross-origin requests initiated from the Photography theme pages.

The vendor ThemeGoods has released Photography theme version 7.7.6, which patches this vulnerability. Site administrators should update the Photography theme to version 7.7.6 or later immediately. As an interim measure, Patchstack has issued a virtual patching/mitigation rule for subscribers to block exploitation attempts until the theme is updated. If neither option is immediately available, consider temporarily disabling the theme or restricting access to affected pages (Patchstack).

The vulnerability was discovered and responsibly disclosed by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity through Patchstack's Active VDP program, with the report submitted on November 29, 2025, and published February 25, 2026. No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified (Patchstack).