CVE-2026-39642

Vulnerability

A basic cross-site scripting (XSS) vulnerability, classified as Improper Neutralization of Script-Related HTML Tags, exists in the Nyla theme by SpabRice. This issue allows code injection. The vulnerability affects all versions from n/a through 1.7 [1].

Exploitation

An attacker can exploit this vulnerability without requiring high privileges; any user capable of inputting shortcodes can inject malicious content. The attack is simple and can be performed remotely. The reference notes that similar vulnerabilities are used in mass-exploit campaigns targeting thousands of websites regardless of traffic size [1].

Impact

Successful exploitation allows an attacker to inject arbitrary content into pages and posts of the affected WordPress site. This could be abused to inject phishing pages, leading to credential theft or other social engineering attacks. The integrity of the website is compromised, affecting both content and user trust.

Mitigation

The recommended immediate action is to update the Nyla theme to a version above 1.7. If immediate update is not possible, users should consult their hosting provider or web developer for assistance [1].