CVE-2026-39748: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ThemeMove EduMall

CVE-2026-39748 is an unauthenticated cross-site scripting (XSS) vulnerability affecting ThemeMove EduMall versions up to 4.5.3. The flaw arises from improper neutralization of input during web page generation, classified under CWE-79. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and scope changed. Successful exploitation can result in limited confidentiality, integrity, and availability impacts.

Exploitation of this vulnerability allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users, potentially leading to theft of sensitive information, session hijacking, or disruption of service. The CVSS vector indicates partial impact on confidentiality, integrity, and availability, reflecting the potential for limited but meaningful damage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should consider applying web application firewalls or input validation controls as temporary mitigations, but these are not guaranteed to fully mitigate the issue.