Cyber Posture

CVE-2026-27088

High

Published: 25 March 2026

Published
25 March 2026
Modified
24 April 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0004 11.8th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27088 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 11.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Threat & Defense at a Glance

What attackers do: exploitation maps to JavaScript (T1059.007) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

SI-15 mandates information output filtering prior to web page generation, directly preventing reflected XSS by neutralizing injected scripts in the Darna Framework.

prevent

SI-10 requires validation of inputs at web entry points, blocking malicious payloads that could be reflected as XSS in vulnerable Darna Framework versions <=2.9.

prevent

SI-2 ensures timely identification and remediation of flaws like CVE-2026-27088 through patching the affected Darna Framework plugin.

MITRE ATT&CK Enterprise TechniquesAI

T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
T1204.001 Malicious Link Execution
An adversary may rely upon a user clicking a malicious link in order to gain execution.
Why these techniques?

Reflected XSS directly enables arbitrary JavaScript execution (T1059.007) in the victim's browser; exploitation requires the victim to click a crafted malicious link (T1204.001).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Darna Framework darna-framework allows Reflected XSS.This issue affects Darna Framework: from n/a through <= 2.9.

Deeper analysisAI

CVE-2026-27088 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as reflected cross-site scripting (XSS), in the G5Theme Darna Framework WordPress plugin (darna-framework). It affects all versions from n/a through 2.9 inclusive. Published on 2026-03-25T17:16:56.473, the issue has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and maps to CWE-79.

Attackers can exploit this remotely over the network with low complexity and no privileges required, though user interaction is needed, such as clicking a malicious link. Exploitation reflects injected scripts during web page generation, enabling limited impacts on confidentiality, integrity, and availability with a changed scope that could affect other users or site resources.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/darna-framework/vulnerability/wordpress-darna-framework-plugin-2-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents the vulnerability in the Darna Framework WordPress plugin version 2.9 and provides associated mitigation guidance.

Details

CWE(s)

CVEs Like This One

CVE-2025-23624Shared CWE-79
CVE-2025-68894Shared CWE-79
CVE-2025-26589Shared CWE-79
CVE-2025-22711Shared CWE-79
CVE-2025-67620Shared CWE-79
CVE-2025-23492Shared CWE-79
CVE-2025-27278Shared CWE-79
CVE-2025-25170Shared CWE-79
CVE-2026-24949Shared CWE-79
CVE-2025-23564Shared CWE-79

References