What is the CVSS score of CVE-2026-41557?

CVE-2026-41557 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Kapee WordPress Theme are affected by CVE-2026-41557?

The Kapee WordPress theme (versions prior to 1.7.1) contains a cross-site scripting vulnerability (CVSS 7.1) that allows unauthenticated attackers to inject malicious scripts into your website.. A patch is available.

How to fix or mitigate CVE-2026-41557?

Within 24 hours: Audit your WordPress installation to identify if Kapee theme is deployed and confirm current version; create full backup. Within 7 days: Either deactivate Kapee theme entirely and switch to an alternative (primary recommendation), or implement Web Application Firewall rules to block XSS payloads if immediate theme removal is not feasible. Within 30 days: Monitor Patchstack and WordPress.org security advisories for Kapee version 1.7.1 or later release; test patch in staging environment and schedule controlled upgrade.

Kapee WordPress Theme CVE-2026-41557

EUVD-2026-37606 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-17 Patchstack

XSS Kapee

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable WordPress theme, no attacker auth (PR:N), but requires victim click (UI:R); reflected XSS escapes theme scope into admin context (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Jun 17, 2026 - 13:01 EUVD

Analysis Generated

Jun 17, 2026 - 12:12 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions.

AnalysisAI

Reflected/stored cross-site scripting in the Kapee WordPress theme versions prior to 1.7.1 allows remote unauthenticated attackers to inject arbitrary script that executes in a victim's browser after user interaction, with a scope change that can impact other components beyond the vulnerable theme. No public exploit identified at time of analysis, but the vulnerability was disclosed via Patchstack with a CVSS of 7.1, reflecting the unauthenticated nature combined with required user interaction.

Technical ContextAI

Kapee is a commercial WordPress theme developed by Presslayouts (CPE cpe:2.3:a:presslayouts:kapee) typically used for e-commerce and WooCommerce-based storefronts. The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controlled input is rendered into HTML/JavaScript responses without adequate output encoding or sanitization. Because WordPress themes commonly render shortcodes, search parameters, product fields, and AJAX endpoints, a CWE-79 issue in the theme layer typically arises from echoing request parameters or unescaped option values into page templates.

RemediationAI

Upgrade the Kapee theme to version 1.7.1 or later, which is the fixed release per Patchstack's advisory at https://patchstack.com/database/wordpress/theme/kapee/vulnerability/wordpress-kapee-theme-1-7-1-cross-site-scripting-xss-vulnerability. Until the upgrade can be applied, deploy a WordPress-aware WAF (such as Patchstack's vPatching or Wordfence) with rules blocking script-injection payloads on theme-handled endpoints, restrict /wp-admin access to known IPs to limit administrator exposure to crafted links, and enforce a strict Content-Security-Policy header disallowing inline scripts - noting that aggressive CSP can break legitimate theme functionality and should be tested in staging. Also instruct administrators to avoid following untrusted links to the site while logged in.