CVE-2026-88420

MediumCVSS 5.4

Published: 25/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 25/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

A reflected cross-site scripting (XSS) vulnerability exists in the EntryAbstract.save() component of APSL puput v1.2.1 through v2.2.0. An authenticated attacker with Wagtail Editor privileges can execute arbitrary code in the victim's browser via a crafted payload.

Risk Assessment

An attacker can hijack a user's session, steal data, or perform actions on behalf of the victim. The risk affects organizations using APSL puput with editor privileges.

Recommendation

Update APSL puput to a version later than v2.2.0 if a fix is available. Restrict editor privileges and validate input.

Other vulnerabilities in APSL puput

CVE-2026-88421High
Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, tag, category, author and date archives, sidebar widgets, or RSS feed.

Original NVD description (English source)

A reflected cross-site scripting (XSS) vulnerability in the EntryAbstract.save() component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers with Wagtail Editor privileges to execute arbitrary code in the context of the victim's browser via a crafted payload.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS