CVE-2024-58292

XMB Forum 1.9.12.06 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript into templates and front page settings. Attackers can insert XSS payloads in footer templates and news ticker fields, enabling script execution for all forum users when pages are rendered.

CVSS 4.0

5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

EPSS

0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-25)

CWE

CWE-79

Published

2025-12-11

Modified

2026-10-02

Record from

the NVD, synced 2026-10-19

References

• https://www.exploit-db.com/exploits/52044
• https://www.vulncheck.com/advisories/xmb-forum-persistent-cross-site-scripting-via-admin-templates
• https://www.xmbforum2.com/

Check your stackJSON