Is there a public PoC exploit available for EUVD-2026-26438?

Yes, a public proof-of-concept exploit is available for EUVD-2026-26438. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for EUVD-2026-26438?

Yes, a patch is available for EUVD-2026-26438. Update the affected software to the latest version immediately.

LinkStack EUVD-2026-26438

Q: What is the CVSS score of EUVD-2026-26438?

EUVD-2026-26438 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7501 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-30 VulDB

PHP XSS

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

PoC Detected

May 01, 2026 - 15:26 vuln.today

Public exploit code

Source Code Evidence Fetched

Apr 30, 2026 - 21:45 vuln.today

Analysis Generated

Apr 30, 2026 - 21:45 vuln.today

CVSS changed

Apr 30, 2026 - 21:22 NVD

3.5 (LOW) 2.0 (LOW)

EUVD ID Assigned

Apr 30, 2026 - 21:15 euvd

EUVD-2026-26438

Analysis Generated

Apr 30, 2026 - 21:15 vuln.today

Patch released

Apr 30, 2026 - 21:15 nvd

Patch available

CVE Published

Apr 30, 2026 - 20:45 nvd

LOW 2.0

DescriptionCVE.org

A weakness has been identified in LinkStackOrg LinkStack up to 4.8.6. Impacted is the function editPage of the file app/Http/Controllers/UserController.php. Executing a manipulation of the argument pageDescription can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a pull request but has not reacted yet.

AnalysisAI

Stored cross-site scripting (XSS) in LinkStack up to version 4.8.6 allows authenticated users to inject malicious scripts via the pageDescription parameter in the editPage function, which are then stored and executed in the browsers of users viewing the affected page. The vulnerability requires user interaction (victim must view the page) and authenticated access, limiting its scope to authenticated attackers, but publicly available exploit code exists and the vendor has provided a fix via pull request #974.

Technical ContextAI

LinkStack is a PHP-based web application built with Laravel. The vulnerability exists in the UserController.php file's editPage function, which processes user-submitted page descriptions without proper output encoding or input sanitization. CWE-79 (Improper Neutralization of Input During Web Page Generation) occurs because user-controlled input from the pageDescription parameter is stored in the database and later rendered in HTML responses without adequate escaping. The fix involves two regex patterns that strip event handler attributes (on* attributes) from the input before storage, preventing inline JavaScript execution. The use of Laravel's templating should provide context-aware escaping, but the application either disables Blade escaping (using triple braces {{{ }}}) or fails to use it correctly for this field.

RemediationAI

Upgrade LinkStack to the patched version released after pull request #974 is merged and tagged; the exact version number is not explicitly stated in references, so verify with the LinkStack project's release page or GitHub tags. If immediate upgrade is not feasible, disable the page editing feature for unprivileged users or implement a strict Content Security Policy (CSP) header with script-src 'self' to prevent inline script execution (trade-off: may break legitimate scripts if the application embeds inline JavaScript elsewhere). Additionally, implement input validation at the application level by using Laravel's built-in sanitization methods (e.g., HTMLPurifier) for rich-text fields before storage. Manual code patching is possible using the regex patterns from PR #974 lines that strip on* attributes, but this is not recommended for production without vendor verification.