CVE-2026-26351

Katalog CVE

CVSS 4.8 · Medium EPSS 0,40%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada getsimple-ce getsimple cms. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

GetSimpleCMS Community Edition (CE) versions prior to 3.3.22 (3.3.16 tested) contains a stored cross-site scripting (XSS) vulnerability in the Theme to Components functionality within components.php. User-supplied input provided to the "slug" field of a component is stored without proper output encoding. While other fields are sanitized using safe_slash_html(), the slug parameter is written to XML and later rendered in the administrative interface without sanitation, resulting in persistent execution of arbitrary JavaScript. An authenticated administrator can inject malicious script content that executes whenever the affected Components page is viewed by any authenticated user, enabling session hijacking, unauthorized administrative actions, and persistent compromise of the CMS administrative interface.

Rincian

Terbit di NVD

24 Februari 2026

Terakhir diubah

14 Juli 2026

Status NVD

Modified

CVSS 3.1

4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.vulncheck.com/advisories/getsimplecms-ce-stored-xss-via-components-php advisory pihak ketiga
• https://getsimple-ce.ovh/ product
• https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/releases/tag/v3.3.22 product · release notes
• https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-95f7-vm92-8gpx broken link