CVE-2026-39626

MediumCVSS 5.3

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

The Armania theme for WordPress has a basic XSS vulnerability due to improper neutralization of script-related HTML tags. This affects versions up to and including 1.4.8.

Risk Assessment

An attacker can inject malicious JavaScript code that executes in the administrator's browser, potentially leading to session hijacking or data theft.

Recommendation

Update the Armania theme to the latest version and avoid using untrusted input in templates.

Original NVD description (English source)

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes Armania armania allows Code Injection.This issue affects Armania: from n/a through <= 1.4.8.