CVE-2026-96819

HighCVSS 7.1

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

oik plugin in versions up to and including 4.15.4 contains a Cross Site Scripting (XSS) vulnerability. It can be exploited by a subscriber-level user.

Risk Assessment

A subscriber can inject a malicious script that executes in other users' browsers, potentially leading to session or data theft.

Recommendation

Update the oik plugin to a version newer than 4.15.4. Consider deploying a WAF filtering XSS attempts.

Other vulnerabilities in oik

CVE-2025-67549Medium
oik up to version 4.15.3 contains a DOM-Based XSS vulnerability due to improper input neutralization during web page generation. This allows an attacker to execute malicious scripts in the victim's browser.

Original NVD description (English source)

Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS