The vulnerability CVE-2026-39628 affects kutethemes DukaMarket versions up to 1.3.0 and is classified as a basic cross-site scripting (XSS) flaw. It arises from improper neutralization of script-related HTML tags in web pages, enabling an attacker to inject code. The CVSS 3.1 base score is 5.3 (medium severity), with an attack vector of network, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation could allow an attacker to inject script code into web pages viewed by other users, potentially leading to limited confidentiality impact. There is no indication of integrity or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, users should monitor vendor communications for updates. In the meantime, consider applying web application firewall (WAF) rules to detect and block suspicious script injections if feasible.