What is the CVSS score of CVE-2026-45026?

CVE-2026-45026 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-45026?

Yes, a patch is available for CVE-2026-45026. Update the affected software to the latest version immediately.

WeGIA CVE-2026-45026

EUVD-2026-29195 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-11 GitHub_M

XSS PHP

6.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.8 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 11, 2026 - 20:02 EUVD

Analysis Generated

May 11, 2026 - 19:47 vuln.today

CVE Published

May 11, 2026 - 18:36 nvd

MEDIUM 6.8

DescriptionGitHub Advisory

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the Processo de Aceitação (html/atendido/processo_aceitacao.php) page, which is executed when user access the the page, enabling session hijacking and account takeover. This vulnerability is fixed in 3.7.3.

AnalysisAI

Stored Cross-Site Scripting in WeGIA versions prior to 3.7.3 allows authenticated high-privilege users to inject malicious JavaScript into the Processo de Aceitação page that executes when any user accesses the vulnerable endpoint, enabling session hijacking and account takeover. The vulnerability is confined to high-privilege authenticated access (PR:H) with no user interaction required on the victim side, though scope is changed (S:C) indicating cross-context impact. No public exploit code or active exploitation has been identified.

Technical ContextAI

WeGIA is a PHP-based web application for managing charitable institution processes. The vulnerability resides in the Processo de Aceitação module (html/atendido/processo_aceitacao.php), a PHP page that processes and displays user-submitted data without proper output encoding or input sanitization. This is a classic CWE-79 Stored XSS flaw where untrusted data is persisted in the application state (likely database or session storage) and later rendered in HTML context without escaping. The attack vector is HTTP/network-based, suggesting the malicious payload is delivered via web form submission or API call to the vulnerable endpoint, then stored server-side and reflected to other users browsing the same page.

RemediationAI

Upgrade WeGIA to version 3.7.3 or later immediately. The vendor has released a patched version addressing the stored XSS vulnerability in the Processo de Aceitação module. If immediate patching is not feasible, implement compensating controls: restrict HTTP access to the vulnerable endpoint (html/atendido/processo_aceitacao.php) using web application firewall rules or reverse proxy to block script-like payloads in POST/GET parameters; disable or revoke high-privilege user accounts that are not actively required for operations, reducing the attack surface; and enable content security policies (CSP) with script-src 'self' to mitigate reflected XSS impact even if stored payloads execute. Note that WAF rules may produce false positives if legitimate administrative workflows require special characters, and CSP may break legitimate page functionality if inline scripts are used.