CVE-2026-39711

MediumCVSS 5.3

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

The RT-Theme 18 | Extensions plugin for WordPress up to version 2.5 inserts sensitive data into sent information. Attackers can retrieve embedded sensitive data.

Risk Assessment

The organization risks leakage of confidential data stored in theme extensions, potentially compromising user privacy.

Recommendation

Update the RT-Theme 18 | Extensions plugin to a version above 2.5 if available, or contact the vendor for a patch.

Original NVD description (English source)

Insertion of Sensitive Information Into Sent Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Retrieve Embedded Sensitive Data.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.