EUVD-2026-27001Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
wCMS v.1.4 is vulnerable to Cross Site Scripting (XSS) when creating a new blog.
AnalysisAI
Stored cross-site scripting (XSS) in wCMS v.1.4 allows remote attackers to inject malicious scripts when creating new blog entries, which are executed in the browsers of other users who view the affected blog. The vulnerability requires user interaction (victim visiting the compromised blog) and affects site confidentiality and integrity. No public exploit code or active exploitation has been confirmed at the time of analysis.
Technical ContextAI
The vulnerability is a stored XSS flaw (CWE-79) in the blog creation functionality of wCMS v.1.4. The application fails to properly sanitize or encode user-supplied input when processing new blog post creation, allowing an attacker to embed arbitrary JavaScript code that persists in the application's database and executes when other users access the affected blog content. This is distinct from reflected XSS because the malicious payload is permanently stored rather than transmitted via request parameters.
RemediationAI
Upgrade to a patched version of wCMS newer than v.1.4 if available from the vendor. Immediate compensating controls include implementing Content Security Policy (CSP) headers to restrict inline script execution and disallow unsafe-inline, which will prevent stored XSS payloads from executing even if present in the DOM-note this requires adjusting any legitimate inline scripts the application relies on. Additionally, apply strict input validation and HTML entity encoding on all blog post submission fields server-side before storage, and implement output encoding when rendering blog content to users. If patched versions are unavailable, consider deploying a Web Application Firewall (WAF) with XSS detection rules to block requests containing script tags or event handlers in blog creation parameters. Consult the vendor or GitHub reference (https://github.com/thv930/yumeng_wu/tree/main/1/readme.md) for the latest security guidance.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today