CVE-2026-105124

11th percentile - higher than 11% of all known CVEs

W (vincent-peugnet/wcms) through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and visitor comment website field. Attackers can submit failed logins rendered unescaped in the adminlog.php log viewer, or comment URLs echoed into href attributes in editrightbar.php, executing script with administrator or editor privileges.

The vulnerability allows execution of arbitrary JavaScript in an administrator's or editor's browser, potentially leading to session hijacking, data theft, or content modification. Since the attack requires no authentication, the risk is high for any wcms instance.

Update wcms to a version later than 3.18.0 that fixes the vulnerability. Until then, consider restricting access to the admin panel and monitoring logs for suspicious entries.