CVE-2026-21269
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A stored Cross-Site Scripting (XSS) vulnerability in the software that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may execute in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Risk Assessment
An attacker could steal user data, hijack sessions, or perform other malicious actions in the victim's context, potentially leading to confidentiality and integrity breaches.
Recommendation
It is recommended to immediately update the software to a patched version that fixes the XSS vulnerability and to review the code for similar issues.
Original NVD description (English source)
is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.