WordPress security by component
kuteshop
kuteshop is a WordPress theme with 4 published CVE records in this archive. The latest tracked vulnerability was published Oct 10, 2026; the highest published CVSS base score is 8.1.
Theme slug:
kuteshopLatest vulnerability
CVE-2026-62115: KuteShop: Filesystem traversal
An unauthenticated caller can influence a local file inclusion operation through attacker-controlled file selection. The export does not identify the endpoint, path parameter, inclusion function or reachable file paths. Code execution would require a suitable file and execution context; this record does not establish that complete chain. The vector requires high attack complexity, but the additional prerequisite is not disclosed. Affected versions: <= 4.2.9. No fixed release is confirmed.
| Safe version |
|
||
|---|---|---|---|
| Oct 10, 2026 |
CVE-2026-62115
KuteShop: Filesystem traversal
An unauthenticated caller can influence a local file inclusion operation through attacker-controlled file selection. The export does not identify the endpoint, path parameter, inclusion function or reachable file paths. Code execution would require a suitable file and execution context; this record does not establish that complete chain. The vector requires high attack complexity, but the additional prerequisite is not disclosed. Affected versions: <= 4.2.9. No fixed release is confirmed.
|
See mitigation notes |
CVE8.1
|
| Oct 10, 2026 |
CVE-2026-62100
KuteShop: Cross-site scripting
An unauthenticated caller can supply script-bearing input that is rendered without sufficient escaping. A victim must view the affected content or crafted request for JavaScript to execute in their browser. The export does not identify the endpoint, input field, rendering function or victim role; administrator takeover is not established. Whether the input is stored or reflected is not disclosed. Affected versions: <= 4.2.9. No fixed release is confirmed.
|
See mitigation notes |
CVE7.1
|
| Apr 08, 2026 |
CVE-2026-39612
KuteShop: A security weakness
KuteShop is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.2.9.
|
See mitigation notes |
CVE5.3
|
| Apr 08, 2026 |
CVE-2026-39611
KuteShop: Filesystem traversal
KuteShop is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is <= 4.2.9.
|
See mitigation notes |
CVE7.5
|