What is the CVSS score of CVE-2026-39629?

CVE-2026-39629 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Uminex CVE-2026-39629

EUVD-2026-20279 MEDIUM

Basic XSS (CWE-80)

2026-04-08 Patchstack

GHSA-g496-v2vq-m798

XSS Uminex

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20279

Analysis Generated

Apr 08, 2026 - 08:45 vuln.today

CVE Published

Apr 08, 2026 - 08:30 nvd

MEDIUM 5.3

DescriptionCVE.org

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes Uminex uminex allows Code Injection.This issue affects Uminex: from n/a through <= 1.0.9.

AnalysisAI

Improper neutralization of script-related HTML tags in the kutethemes Uminex WordPress theme version 1.0.9 and earlier enables unauthenticated remote attackers to inject arbitrary code via cross-site scripting (XSS), resulting in limited information disclosure. The vulnerability has an EPSS score of 0.03% (8th percentile), indicating minimal real-world exploitation probability despite a CVSS base score of 5.3; no public exploit code or active exploitation has been identified.

Technical ContextAI

The vulnerability stems from CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page), a foundational XSS weakness where user-controlled input is reflected in HTML context without proper sanitization or output encoding. The affected product is the Uminex WordPress theme (CPE: cpe:2.3:a:kutethemes:uminex:*:*:*:*:*:*:*:*), a server-side WordPress theme component. The basic XSS variant allows attackers to inject malicious script tags or event handlers that execute in the context of a user's browser session, though the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L) indicates no user interaction is required for exploitation and impact is limited to confidentiality (information disclosure), with no integrity or availability impact.

RemediationAI

Upgrade the kutethemes Uminex theme to a version newer than 1.0.9. Consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/uminex/vulnerability/wordpress-uminex-theme-1-0-9-arbitrary-shortcode-execution-vulnerability?_s_id=cve) for the specific patched release version and installation instructions. If an upgrade is not immediately available, apply input validation and output encoding filters to any user-controllable fields rendered in HTML context, and implement a Web Application Firewall rule to block script injection patterns.