CVE-2026-38947

MediumCVSS 6.1

Published: 05/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

FluentCMS 1.2.3 is vulnerable to XSS in the TextHTML plugin. An attacker can inject malicious script that executes in the victim's browser.

Risk of user session theft, account takeover, or sensitive data leakage via malicious JavaScript execution.

Update FluentCMS to the latest patched version. Restrict TextHTML plugin usage to trusted users.

Original NVD description (English source)

FluentCMS 1.2.3 is vulnerable to Cross Site Scripting (XSS) in TextHTML plugin.