Is CVE-2026-39628 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39628 being exploited in the wild.

How severe is CVE-2026-39628?

Medium severity, with a CVSS score of 5.3, published 8 April 2026.

Which products and versions are affected?

KuteThemes DukaMarket <= 1.3.0.

Is there a fix for CVE-2026-39628?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-39628 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-39628?

Check whether you run KuteThemes DukaMarket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39628: kutethemes DukaMarket XSS and Content Injection

Q: Is there a fix for CVE-2026-39628?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-39628 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-39628?

Check whether you run KuteThemes DukaMarket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39628 · Severity: medium · CVSS 5.3 · Published 2026-04-08

DukaMarket is a WordPress theme used for building e-commerce websites. A security flaw in the theme allows unauthorized individuals to inject malicious scripts or content into the website. This could lead to the display of fraudulent information, phishing pages, or the theft of visitor information, potentially damaging the site's reputation and customer trust.

Vendors: KuteThemes.

Quick answers

Is CVE-2026-39628 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39628 being exploited in the wild.
How severe is CVE-2026-39628?: Medium severity, with a CVSS score of 5.3, published 8 April 2026.
Which products and versions are affected?: KuteThemes DukaMarket <= 1.3.0.
Is there a fix for CVE-2026-39628?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-39628 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-39628?: Check whether you run KuteThemes DukaMarket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The DukaMarket theme for WordPress (versions up to and including 1.3.0) suffers from a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of script-related HTML tags. This flaw allows an unauthenticated remote attacker to perform code injection or arbitrary shortcode execution. The vulnerability is classified under CWE-80 (Basic XSS) and CWE-79. An attacker can exploit this by sending a specially crafted request to a site running the vulnerable theme, potentially leading to unauthorized content modification or the execution of malicious scripts in the context of a user's browser. As of the advisory date, no official patch has been released.

Affected products

kutethemes DukaMarket <= 1.3.0

Timeline

2026-01-13: other: Vulnerability reported by researcher João Pedro S Alcântara
2026-02-12: advisory: Initial advisory published by Patchstack
2026-04-08: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.