CVE-2026-62100
HighCVSS 7.1Summary
The KuteShop theme in versions up to and including 4.2.9 contains an unauthenticated Cross Site Scripting (XSS) flaw. It allows injection of malicious script into site pages.
Risk Assessment
An unauthenticated attacker can inject malicious script, risking session theft or modification of content visible to users.
Recommendation
Update the KuteShop theme to a version newer than 4.2.9 or disable it if an update is not possible.
Other vulnerabilities in KuteShop
See all- CVE-2026-62115High
The KuteShop theme in versions up to and including 4.2.9 is vulnerable to unauthenticated Local File Inclusion. An attacker can load files from the server.
- CVE-2026-39612Medium
The KuteShop WordPress theme has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 4.2.9.
- CVE-2026-39611High
The KuteShop WordPress theme contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. Attackers can read arbitrary files on the server.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS