CVSS 4.0
9.3 criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:NCVE-2026-46396
Critical (9.3). EPSS 0.2% chance of exploitation in the next 30 days. Fixed in @haxtheweb/haxcms-nodejs 26.0.0.
HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of `<iframe>` elements. The application allows `javascript:` URIs in the `src` attribute, which are executed when a malicious page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data exposed to client-side scripts. Version 26.0.0 fixes the issue.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jh3h-rpxg-fr36 | npm | @haxtheweb/haxcms-nodejs | <26.0.0 | 26.0.0 |
| GHSA-jh3h-rpxg-fr36 | npm | @haxtheweb/video-player | <26.0.0 | 26.0.0 |
| GHSA-jh3h-rpxg-fr36 | npm | @haxtheweb/iframe-loader | <26.0.0 | 26.0.0 |