CVE-2026-27367 is a reflected cross-site scripting vulnerability in ThemeGoods Musico prior to version 3.4.5. The issue is caused by improper neutralization of input during web page generation, which allows an attacker to inject malicious scripts that execute in the context of a user's browser session. This can lead to limited impacts on confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. No patch or official vendor advisory is currently provided in the input data.

Successful exploitation of this reflected XSS vulnerability can lead to limited confidentiality, integrity, and availability impacts, such as theft of user credentials, session hijacking, or execution of arbitrary scripts in the victim's browser. However, no known exploits in the wild have been reported. The vulnerability requires user interaction and can be triggered remotely over the network without privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor ThemeGoods communications for an official fix or update to Musico version 3.4.5 or later. Until a patch is available, consider applying web application firewall (WAF) rules to detect and block reflected XSS attempts targeting Musico. Avoid clicking on suspicious links that may exploit this vulnerability.