CVE-2026-62098
MediumCVSS 6.5Summary
The Boutique plugin in versions up to 2.3.3 contains an unauthenticated content injection vulnerability. An unauthenticated attacker can inject arbitrary content.
Risk Assessment
Malicious content may be injected into the site, potentially leading to phishing, defacement, or distribution of harmful scripts.
Recommendation
Update the Boutique plugin to a version later than 2.3.3.
Other vulnerabilities in Boutique
See all- CVE-2026-62099High
The Boutique theme in versions up to and including 2.3.3 is vulnerable to unauthenticated Local File Inclusion. An attacker can load files from the server.
- CVE-2026-39613High
The Boutique (kute-boutique) WordPress theme contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. Attackers can read arbitrary files on the server.
Original NVD description (English source)
Unauthenticated Content Injection in Boutique <= 2.3.3 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS