CVE-2026-39618

MediumCVSS 4.3

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

1th percentile - higher than 1% of all known CVEs

Summary

The NewsExo theme (themearile) contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can trick an administrator into performing unwanted actions.

Risk Assessment

A CSRF attack may allow changing theme settings or performing other operations without the administrator's consent.

Recommendation

Update the NewsExo theme to version later than 7.1 or apply a patch from the vendor.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in themearile NewsExo newsexo allows Cross Site Request Forgery.This issue affects NewsExo: from n/a through <= 7.1.