This vulnerability (CVE-2026-27358) affects ThemeGoods Architecturer prior to version 3.9.5 and is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It allows reflected cross-site scripting attacks by failing to properly sanitize user input before including it in web pages. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or official remediation guidance is currently documented.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The CVSS score of 7.1 indicates a high impact, but exploitation requires user interaction. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying web application firewalls or input validation controls as temporary mitigations. Avoid clicking suspicious links that could trigger reflected XSS attacks. Monitor vendor communications for updates on patches or official fixes.