CVE-2026-115606

HighCVSS 7.1

Published: 28/10/2026(UTC)Updated: 28/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows Stored XSS. This issue affects DXP ToolKit: from n/a through 2.0.1.

Risk Assessment

Stored XSS may allow an attacker to inject a malicious script that executes in a user's browser, potentially leading to session or data theft.

Recommendation

Update the DXP ToolKit plugin to a version later than 2.0.1. Apply input validation and encoding in the application.

Other vulnerabilities in DXP ToolKit

CVE-2026-115607Critical
The Crowd Favorite DXP ToolKit plugin contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This issue affects DXP ToolKit versions from n/a through 2.0.1.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows Stored XSS.This issue affects DXP ToolKit: from n/a through 2.0.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS