Which versions of PHP are affected by CVE-2026-4973?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4973, a cross-site scripting vulnerability rated CVSS 5.1.

How to fix or mitigate CVE-2026-4973?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

PHP CVE-2026-4973

Q: What is the CVSS score of CVE-2026-4973?

CVE-2026-4973 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16807 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-03-27 cna@vuldb.com

PHP XSS

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

EUVD ID Assigned

Mar 27, 2026 - 20:22 euvd

EUVD-2026-16807

Analysis Generated

Mar 27, 2026 - 20:22 vuln.today

CVE Published

Mar 27, 2026 - 20:16 nvd

MEDIUM 5.1

DescriptionCVE.org

A vulnerability was detected in SourceCodester Online Quiz System hasta 1.0. Affected by this vulnerability is an unknown functionality of the file endpoint/add-question.php. Performing a manipulation of the argument quiz_question results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used.

AnalysisAI

Stored cross-site scripting (XSS) in SourceCodester Online Quiz System up to version 1.0 allows authenticated remote attackers to inject malicious scripts via the quiz_question parameter in endpoint/add-question.php, affecting users who view the injected quiz content. The vulnerability has CVSS 5.1 (low-to-moderate severity), requires user interaction to trigger, and public exploit code is available. An attacker with quiz management privileges can compromise quiz participants through JavaScript execution in their browsers.

Technical ContextAI

The vulnerability resides in a PHP-based web application (SourceCodester Online Quiz System) that processes user-supplied input in the quiz_question parameter without proper output encoding or input validation. The vulnerable endpoint endpoint/add-question.php appears to store quiz question data in a backend database without sanitizing HTML/JavaScript content. When other users or administrators view the quiz content, the unescaped script executes in their browser context, classified as CWE-79 (Cross-site Scripting). The application is written in PHP and exposed via HTTP/HTTPS (network-accessible), making it vulnerable to remote exploitation by any authenticated user with quiz creation or editing privileges.

RemediationAI

Primary remediation is to upgrade SourceCodester Online Quiz System beyond version 1.0; contact the vendor at www.sourcecodester.com for patched releases or check for available updates. If an upgrade is not immediately available, implement input validation and output encoding on the quiz_question parameter: (1) sanitize all user input using a whitelist of allowed characters or an HTML purifier library (e.g., HTMLPurifier for PHP) before storage; (2) apply HTML entity encoding (htmlspecialchars() or htmlentities() in PHP) when displaying quiz questions to prevent script execution. Additionally, implement Content Security Policy (CSP) headers to restrict inline script execution and reduce XSS impact. References: https://vuldb.com/?id.353860 and https://vuldb.com/?ctiid.353860 contain technical details and proof-of-concept information.