Armania Theme CVE-2026-62091

Exploitation requires an attacker to deliver a crafted link containing the XSS payload to a victim and have that victim open it in a browser (UI:R) - reflected XSS is not stored, so there is no persistent trigger and no server-side state change. The condition is unauthenticated reachability of an Armania theme page (<= 1.4.8) that reflects attacker-controlled input without proper output encoding. Limiting factors: success depends entirely on social-engineering the victim into clicking, the payload executes only in that individual victim's session, and impact scales with the privilege of the tricked user (greatest if an administrator is targeted). Sites running Armania 1.4.9+ or with WAF/input-filtering in front are not affected.

This is a reflected Cross-Site Scripting flaw (CWE-79) in the Armania WordPress theme by KuteThemes, rated CVSS 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C. The network vector, low complexity, and lack of required privileges (PR:N) make it reachable by unauthenticated remote attackers, but UI:R means a victim must be induced to click a crafted link - a meaningful limiting factor that keeps this from being a wormable or mass-automatable issue. The elevated 7.1 score is driven largely by the scope change (S:C), reflecting XSS crossing the trust boundary into the victim's authenticated browser session. No EPSS score, CISA KEV listing, or public proof-of-concept is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Reflected XSS requiring user interaction in a niche commercial theme is typically opportunistic/targeted rather than widespread; practical priority is MEDIUM - patch in the normal cycle unless the theme is deployed on a high-value or administrator-facing site. The input lists A:L (availability impact) for a reflected XSS, which is unusual - reflected XSS normally has no availability impact - and this appears to be a conservative/inflated vendor scoring choice worth noting.

An attacker crafts a URL to a vulnerable Armania-themed WordPress site embedding malicious JavaScript in an unsanitized reflected parameter, then delivers it to a logged-in user or administrator via phishing, a forum post, or a malicious link. When the victim clicks, the script executes in their browser under the site's origin, enabling session/cookie theft or actions performed as the victim. No public exploit code is identified in the provided data, and successful exploitation depends on the victim interacting with the attacker-supplied link (UI:R).