CVE-2026-27352
Reflected XSS in ThemeGoods Starto ≤ 2.1.9 Allows Code Injection
Publication date: 2026-03-05
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| themegoods | starto | to 2.1.9 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-27352 is a medium priority Cross Site Scripting (XSS) vulnerability affecting the WordPress Starto Theme versions up to and including 2.1.9.
This vulnerability allows an attacker to inject malicious scripts—such as redirects, advertisements, or other HTML payloads—into a website. These scripts execute when visitors access the compromised site.
Exploitation requires user interaction by a privileged user, such as clicking a malicious link, visiting a crafted page, or submitting a form, although no authentication is required to initiate the attack.
The vulnerability falls under the OWASP Top 10 category A3: Injection and is classified specifically as Cross Site Scripting (XSS).
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to inject malicious scripts into your website, which can execute when visitors access your site.
- Attackers can use this to redirect users to malicious sites.
- It can be used to display unwanted advertisements or malicious HTML payloads.
- It may lead to theft of user data or session hijacking if exploited.
Since exploitation requires user interaction but no authentication, any visitor or privileged user clicking a crafted link or submitting a malicious form can trigger the attack.
No official patch is currently available, but mitigation rules from Patchstack can help block attacks targeting this flaw.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is a Reflected Cross Site Scripting (XSS) issue in the WordPress Starto Theme up to version 2.1.9. Detection typically involves monitoring for unusual or malicious script injections in web requests or responses.
Since no official patch is available, detection can be aided by applying Patchstack’s mitigation rules which help block attacks targeting this flaw.
Specific commands are not provided in the available resources, but common detection methods include using web application firewalls (WAFs) with rules targeting XSS, inspecting HTTP request parameters for suspicious script tags, and using security scanners that test for reflected XSS vulnerabilities.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the Patchstack mitigation rule designed to block attacks targeting this vulnerability until an official patch is released.
Additionally, users should avoid clicking on suspicious links or visiting untrusted pages that could exploit this reflected XSS vulnerability.
Monitoring and restricting user input and ensuring proper input validation can also help reduce the risk of exploitation.