EUVD-2026-56023
GHSA-7g6m-7cgf-xmj8
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-delivered stored XSS requires a registered account (PR:L) and active admin interaction (UI:R); scope change (S:C) reflects session impact crossing to administrator context with limited confidentiality and integrity effect.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
1DescriptionCVE.org
A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields cust_blurb and cust_locate. The fields are saved without HTML encoding and rendered unescaped in profile views visible to administrators. An attacker can craft a payload that executes in an administrator session, enabling session hijacking or privilege escalation.
AnalysisAI
Stored cross-site scripting in ElkArte Forum 2.0 Beta 1 enables any registered member to persist malicious JavaScript in the cust_blurb and cust_locate profile fields, which render unescaped when administrators view affected profiles. The scope-changing nature of the flaw (CVSS S:C) means the payload executes within an administrator's browser session, creating a realistic path to session hijacking or privilege escalation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation - any registered account suffices - makes this a meaningful risk for forums with open registration.
Technical ContextAI
ElkArte Forum (CPE: cpe:2.3:a:elkarte_forum:elkarte) is an open-source PHP-based community forum. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored (persistent) variant. The root cause is absent server-side output encoding: the custom profile fields cust_blurb and cust_locate accept arbitrary user input that is written directly to the database and later echoed into profile view templates without HTML entity encoding or Content Security Policy mitigation. Because profile pages are rendered for all viewers, including privileged administrators, the injected payload executes in an elevated browser context rather than the attacker's own session.
RemediationAI
No vendor-released patched version has been independently confirmed at time of analysis - affected versions inferred from EUVD data and the upstream GitHub repository (https://github.com/elkarte/Elkarte). Administrators should monitor the ElkArte GitHub repository for commits addressing output encoding in profile field rendering. As an immediate compensating control, disable or restrict access to the cust_blurb and cust_locate custom profile fields through the admin panel if these fields are not operationally required; this removes the injection surface entirely with no functional loss for forums that do not use them. Alternatively, restrict new member registrations or require admin approval for new accounts, raising the bar for the PR:L prerequisite. Implementing a Content Security Policy header that blocks inline script execution would significantly reduce exploitability even if the underlying encoding flaw persists, though CSP configuration complexity may introduce its own risks if misconfigured.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today