Is CVE-2026-39626 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39626 being exploited in the wild.

How severe is CVE-2026-39626?

Medium severity, with a CVSS score of 5.3, published 8 April 2026.

Is there a fix for CVE-2026-39626?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-39626 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-39626?

Check whether you run KuteThemes Armania at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39626: kutethemes Armania XSS and Content Injection

CVE-2026-39626 · Severity: medium · CVSS 5.3 · Published 2026-04-08

The Armania WordPress theme is vulnerable to a security flaw that allows unauthorized individuals to inject malicious code or content into the website. This could lead to the display of fraudulent information, phishing pages, or the execution of unauthorized scripts in a visitor's browser. Because this affects the visual and functional integrity of the site, it could damage a company's reputation or be used to deceive customers.

Vendors: KuteThemes.

Quick answers

Is CVE-2026-39626 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39626 being exploited in the wild.
How severe is CVE-2026-39626?: Medium severity, with a CVSS score of 5.3, published 8 April 2026.
Which products and versions are affected?: KuteThemes Armania <= 1.4.8.
Is there a fix for CVE-2026-39626?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-39626 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-39626?: Check whether you run KuteThemes Armania at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the kutethemes Armania theme (versions up to and including 1.4.8) due to improper neutralization of script-related HTML tags. This flaw allows an unauthenticated remote attacker to perform Cross-Site Scripting (XSS) and arbitrary shortcode execution. The root cause is a failure to sufficiently sanitize user-supplied input before rendering it in a web page. An attacker can exploit this to inject malicious scripts or content, potentially leading to session hijacking or the creation of phishing pages. As of the advisory date, no official patch has been released.

Affected products

kutethemes Armania <= 1.4.8

Timeline

2026-01-12: other: Vulnerability reported by researcher João Pedro S Alcântara (Kinorth)
2026-02-11: advisory: Initial advisory published by Patchstack
2026-04-08: disclosed: CVE-2026-39626 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.