CVE-2026-27382

The vulnerability is a DOM-Based Cross-Site Scripting (XSS) issue in the Metro theme for WordPress, affecting versions up to and including 2.13. The root cause is improper neutralization of user input during web page generation, allowing an attacker to inject arbitrary JavaScript that executes in the context of the victim's browser [1].

Exploitation requires user interaction, such as clicking a malicious link or visiting a crafted page. The attacker does not need authentication, but the victim must perform an action for the payload to execute. This makes it suitable for mass-exploit campaigns targeting thousands of websites [1].

Successful exploitation enables the attacker to inject malicious scripts, including redirects, advertisements, or other HTML payloads. These scripts execute when visitors access the compromised site, potentially leading to data theft, defacement, or further attacks [1].

Mitigation is available by updating the Metro theme to a patched version. For users unable to update immediately, Patchstack has issued a mitigation rule to block attacks until an official patch can be applied [1].