CVE Catalog
CVE-2026-39628
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk0.26%
18th percentile - higher than 18% of all known CVEs
Summary
The DukaMarket theme by kutethemes up to version 1.3.0 has a basic XSS vulnerability, allowing code injection due to improper neutralization of script-related HTML tags.
Risk Assessment
An attacker can inject malicious scripts that execute in visitors' browsers, potentially leading to data theft or other attacks.
Recommendation
Update the DukaMarket theme to a version above 1.3.0.
Original NVD description (English source)
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes DukaMarket dukamarket allows Code Injection.This issue affects DukaMarket: from n/a through <= 1.3.0.