CVE-2026-27358

High

Published: 05 March 2026

Published

05 March 2026

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0004 14.4th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27358 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2026-27358 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Architecturer WordPress theme developed by ThemeGoods. The issue affects all versions of the Architecturer theme from n/a through those prior to 3.9.5.

With a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the vulnerability enables exploitation over the network by unauthenticated attackers requiring low complexity and user interaction. An attacker can deliver a malicious payload via a crafted link or input that reflects back unneutralized on the web page, executing arbitrary JavaScript in the victim's browser within the site's context upon interaction, such as clicking the link, potentially compromising low levels of confidentiality, integrity, and availability.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/architecturer/vulnerability/wordpress-architecturer-theme-3-8-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve details the Reflected XSS vulnerability, with mitigation achieved by updating the Architecturer theme to version 3.9.5 or later.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-9621

Vulnerability details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Architecturer architecturer allows Reflected XSS.This issue affects Architecturer: from n/a through < 3.9.5.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

T1204.001 Malicious Link Execution

An adversary may rely upon a user clicking a malicious link in order to gain execution.

attack.mitre.org →

Why these techniques?

Reflected XSS in public-facing WordPress theme directly enables exploitation of the web app (T1190) via crafted malicious links (T1204.001) that execute arbitrary JavaScript (T1059.007) in the victim's browser.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1