Microweber CMS CVE-2026-67617

Admin-level authentication to the Microweber CMS application is required to stage the injection - this is the single most significant limiting condition, confirmed by PR:H in the CVSS 4.0 vector. The content tagging feature must be reachable by the authenticated admin via GET /api/save_content_admin, which is present in default installations through 2.0.20 with no non-default configuration required. The three sanitization bypasses (HTTP-method-blind middleware, narrow unsafe-attribute pattern, decimal entity passthrough) are inherent default behaviors of the codebase - no special mode or feature flag is needed to trigger them. For the stored payload to execute against blog visitors, the public blog page must be live and accessed; for execution in the admin editor, another admin must open the affected post. No special operating system, hosting environment, or plugin configuration beyond a default Microweber installation is required. What limits exploitation: the PR:H admin credential requirement is the primary real-world barrier; absence of a KEV listing suggests no confirmed opportunistic mass targeting at time of analysis.

The CVSS 4.0 score of 4.8 (Medium) is appropriate and reflects the key limiting factor: PR:H requires admin-level authentication before the injection can be staged. The attack vector is network (AV:N) with low complexity once authenticated, so the real-world gate is credential possession, not technical difficulty. Subsequent-system impact is rated Low/Low (SC:L/SI:L) in the CVSS 4.0 vector, consistent with a cross-origin script reaching victim sessions rather than directly compromising server-side resources. Three significant risk amplifiers elevate practical concern beyond the raw score: a public POC exists on GitHub, sharply reducing the skill threshold for exploitation; the payload persists and fires for every blog visitor with zero further interaction, creating a broad blast radius from a single admin compromise; and the CSRF token reuse path enables authenticated actions on behalf of victims, including potential privilege escalation chains if the affected instance has multiple admins. The primary mitigant is the PR:H prerequisite - this is not remotely exploitable without prior admin compromise. EPSS data was not provided. No KEV listing exists, indicating no confirmed mass exploitation. In multi-tenant SaaS deployments of Microweber or environments where admin credentials are shared or weakly protected, practical risk is meaningfully higher than the numeric score implies.

An attacker holding Microweber admin credentials submits a GET request to /api/save_content_admin with a tag_names value containing a decimal entity-encoded event-handler payload - bypassing the middleware, strip_unsafe pattern, and titlecase normalizer - causing the script to be written to the database. Every visitor to the public blog page thereafter executes the payload, which silently reads the CSRF token embedded in the page and issues authenticated same-origin fetch requests to perform admin-level actions on the victim's behalf. A public POC demonstrating this full chain is available at https://github.com/theopaid/Stored-XSS-via-Content-Tag-Names-Microweber-.