CVE-2026-33386
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
QuickCMS is vulnerable to Cross-Site Scripting (XSS) through its insecure HTTP-based plugin-fetching mechanism. An attacker can perform a Man-in-the-Middle (MITM) attack by impersonating the opensolution.org server and serving arbitrary HTML or JavaScript at the plugin list endpoint. The issue was fixed in a patch to version 6.8 published on 15.05.2026.
Risk Assessment
The risk is execution of malicious scripts in the user's browser, which can lead to session theft, data leakage, or further attacks on the system.
Recommendation
It is recommended to immediately apply the patch to QuickCMS version 6.8 published on 15.05.2026 or upgrade to a newer version.
Original NVD description (English source)
QuickCMS is vulnerable to Cross-Site Scripting (XSS) through its insecure HTTP-based plugin‑fetching mechanism. A malicious attacker can perform a Man‑in‑the‑Middle (MITM) attack by impersonating the opensolution.org server and serving arbitrary HTML or JavaScript at the plugin list endpoint. When a user accesses the plugin page, the malicious content is automatically fetched, rendered, and executed. This issue was fixed in a patch to version 6.8 published on 15.05.2026, deployments without this patch are still vulnerable.