Cross-Site Scripting Vulnerability in QantumThemes Kentha
CVE-2026-25442

7.1HIGH

Key Information:

Vendor

WordPress
Status
Kentha
Vendor
CVE Published:
19 March 2026

What is CVE-2026-25442?

The Kentha theme by QantumThemes is susceptible to a reflected cross-site scripting (XSS) vulnerability that allows attackers to inject hostile scripts into web pages. This flaw affects users accessing specifically crafted URLs, which can lead to potential data theft or unauthorized actions performed on behalf of the user without their consent. It is crucial for administrators using Kentha versions up to 4.7.2 to apply appropriate patches and implement security measures to mitigate risks. Ensuring your website is protected against such vulnerabilities is essential for maintaining user trust and data integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Kentha <= 4.7.2

References

https://patchstack.com/database/wordpress/theme/kentha/vu...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro S Alcântara (Kinorth) | Patchstack Bug Bounty Program
JSON
.