CVE-2026-27382
Published: 05 March 2026
Summary
CVE-2026-27382 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious Link (T1204.001); ranked at the 14.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-27382 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as DOM-Based Cross-site Scripting (XSS, CWE-79), in the RadiusTheme Metro WordPress theme. This issue affects Metro versions from n/a through 2.13 inclusive.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction needed, with changed scope. Remote attackers can exploit it by tricking authenticated users into performing actions such as visiting a maliciously crafted link, enabling arbitrary JavaScript execution in the victim's browser context and resulting in low impacts to confidentiality, integrity, and availability.
Patchstack provides details on the vulnerability and mitigation in its advisory at https://patchstack.com/database/Wordpress/Theme/metro/vulnerability/wordpress-metro-theme-2-13-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9635
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme Metro metro allows DOM-Based XSS.This issue affects Metro: from n/a through <= 2.13.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
DOM-based reflected XSS enables arbitrary JS execution in browser (T1059.007) when victim visits attacker-crafted link (T1204.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of untrusted input before it is used in web page generation, blocking the DOM-based XSS payload in the Metro theme.
Requires filtering of information output by the application to neutralize script content, preventing execution of attacker-supplied JavaScript in the victim's browser context.
Provides mechanisms to detect and block malicious code (including injected scripts) before it reaches the browser, mitigating the reflected XSS vector described in the CVE.