CVE-2026-22329 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting Themeum Skillate versions <=1.2.10. The issue stems from improper neutralization of input during web page generation, categorized under CWE-79. The vulnerability allows an attacker to inject malicious scripts that execute in the context of the victim's browser, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS v3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and scope change. There is no vendor advisory or patch currently available for this vulnerability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users visiting the affected Skillate web application, potentially leading to partial disclosure of sensitive information, modification of data, or disruption of service. The CVSS score indicates partial impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying web application firewalls or input validation controls as temporary mitigations. Monitor official Themeum channels for updates.