CVE-2026-27430

HighCVSS 7.1

Published: 02/07/2026(UTC)Updated: 02/07/2026(UTC)Translated: 03/07/2026(UTC)NVD NIST

Summary

TheFox plugin versions up to 3.9.76 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can inject malicious script without authentication.

Risk Assessment

The risk involves arbitrary JavaScript execution in the victim's browser, potentially leading to session theft, redirects to malicious sites, or data theft.

Recommendation

Immediately update TheFox plugin to a version newer than 3.9.76. Also review configuration for XSS filters.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions.