CVE-2026-62091: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in kutethemes Armania

This vulnerability (CWE-79) in Armania (<= 1.4.8) allows unauthenticated attackers to perform cross-site scripting (XSS) attacks due to improper input neutralization during web page generation. The CVSS 3.1 score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. No patch or remediation information is currently provided.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The vulnerability is exploitable remotely without authentication but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider applying input validation or output encoding workarounds if feasible. Monitor vendor channels for updates.