CVE-2026-39626
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Armania theme for WordPress has a basic XSS vulnerability due to improper neutralization of script-related HTML tags. This affects versions up to and including 1.4.8.
Risk Assessment
An attacker can inject malicious JavaScript code that executes in the administrator's browser, potentially leading to session hijacking or data theft.
Recommendation
Update the Armania theme to the latest version and avoid using untrusted input in templates.
Other vulnerabilities in Armania
See all- CVE-2026-62092High
Unauthenticated Local File Inclusion (LFI) in Armania versions up to 1.4.8. Allows an attacker to read files from the server without authentication.
- CVE-2026-62091High
Unauthenticated Cross Site Scripting (XSS) in Armania versions up to 1.4.8. Allows an attacker to inject malicious scripts into a victim's browser.
Original NVD description (English source)
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes Armania armania allows Code Injection.This issue affects Armania: from n/a through <= 1.4.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS