CVE-2026-27430

HighCVSS 7.1

Published: 02/07/2026(UTC)Updated: 25/10/2026(UTC)Translated: 03/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

TheFox plugin versions up to 3.9.76 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can inject malicious script without authentication.

Risk Assessment

The risk involves arbitrary JavaScript execution in the victim's browser, potentially leading to session theft, redirects to malicious sites, or data theft.

Recommendation

Immediately update TheFox plugin to a version newer than 3.9.76. Also review configuration for XSS filters.

Other vulnerabilities in TheFox

CVE-2026-57684Medium
The TheFox plugin for WordPress versions 3.9.70 and earlier contains a Cross Site Scripting (XSS) vulnerability in the Contributor function. It allows an attacker to inject malicious JavaScript code into the page.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS