CVE-2026-39748
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A vulnerability in the EduMall theme up to version 4.5.3 allows an unauthenticated attacker to perform cross-site scripting (XSS).
Risk Assessment
An unauthenticated attacker can inject malicious scripts that execute in the user's browser, potentially leading to session theft, account takeover, or other attacks.
Recommendation
Update the EduMall theme to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in EduMall
See all- CVE-2026-57797Medium
The EduMall WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 4.5.1.
- CVE-2025-59564High
The EduMall theme by ThemeMove has a PHP Local File Inclusion vulnerability due to improper filename control in include/require statements. Affects versions up to 4.4.5 (exclusive).
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS