CVE-2026-29598

7th percentile - higher than 7% of all known CVEs

Multiple stored cross-site scripting (XSS) vulnerabilities were discovered in the submit_add_user.asp endpoint of DDSN Interactive Acora CMS v10.7.1. Attackers can inject malicious JavaScript or HTML payloads into the First Name and Last Name parameters, leading to script execution in other users' browsers.

The risk includes session theft, administrator account takeover, or sensitive data leakage through arbitrary script execution within the application context. This can be leveraged for further privilege escalation within the organization.

Immediately upgrade Acora CMS to the latest patched version. As a temporary measure, implement input validation and sanitization for the First Name and Last Name parameters, and enforce a Content Security Policy (CSP).