CVE-2026-39625
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The WordPress theme TechOne (techone) by kutethemes has a basic XSS vulnerability due to improper neutralization of script-related HTML tags. This allows code injection and affects versions up to and including 3.0.3.
Risk Assessment
An attacker can inject malicious JavaScript that executes in visitors' browsers, potentially leading to session data theft or redirects.
Recommendation
Update the TechOne theme to a version above 3.0.3 if a patch is available, or apply input filtering and output encoding.
Other vulnerabilities in TechOne
See all- CVE-2026-62094High
Unauthenticated Local File Inclusion (LFI) in TechOne versions up to 3.0.3. Allows an attacker to read files from the server without authentication.
- CVE-2026-62093High
Unauthenticated Cross Site Scripting (XSS) in TechOne versions up to 3.0.3. Allows an attacker to inject malicious scripts into a victim's browser.
Original NVD description (English source)
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes TechOne techone allows Code Injection.This issue affects TechOne: from n/a through <= 3.0.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS