EUVD-2026-52487
GHSA-793c-7c93-m769
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable stored XSS requiring admin credentials (PR:H), scope changes to victim browsers (S:C), limited C/I impact, no availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tag_names parameter of the GET /api/save_content_admin endpoint, bypassing three independent sanitization controls including XSS middleware that ignores GET requests, a strip_unsafe() function that only matches double-quoted onerror attributes, and a titlecase normalizer that passes HTML decimal entity-encoded payloads through unchanged. Attackers can store malicious scripts that execute without user interaction for every visitor to the public blog page and within the admin post editor, enabling session riding through same-origin fetch requests using the CSRF token embedded in the page.
AnalysisAI
Stored XSS in Microweber CMS through version 2.0.20 allows admin-authenticated attackers to persist arbitrary JavaScript via the tag_names parameter of the GET /api/save_content_admin endpoint, defeating three independent sanitization layers through a combination of HTTP-method blind middleware, an overly narrow unsafe-attribute pattern, and a titlecase normalizer that passes HTML decimal entity-encoded payloads unchanged. Injected scripts execute silently for every public blog visitor and within the admin post editor, enabling same-origin CSRF token abuse for session riding and account takeover chaining. A public proof-of-concept exploit exists; no CISA KEV listing is present at time of analysis.
Technical ContextAI
Microweber is a PHP-based open-source CMS (CPE: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*) whose content tagging subsystem accepts free-form tag names through a GET-method API mutation endpoint - an architectural anomaly that is itself the root of the first bypass. CWE-79 (Improper Neutralization of Input During Web Page Generation) applies across three distinct sanitization failures that compound rather than overlap: (1) the XSS middleware inspects only POST bodies, leaving the GET /api/save_content_admin surface entirely unscreened; (2) the strip_unsafe() function relies on a literal pattern matching double-quoted onerror attributes, failing to catch single-quoted variants, alternate event handlers, or non-attribute payloads; and (3) a titlecase normalizer intended to clean tag display strings passes HTML decimal numeric character references (e.g. < for <) unmodified, which compliant browsers decode at render time before any downstream escaping can occur. The stored tag value is later reflected without encoding on the public blog listing page and within the admin post editor, providing two distinct persistent execution surfaces.
RemediationAI
No vendor-released patch has been confirmed at time of analysis - neither the VulnCheck advisory nor the POC repository specifies a fixed Microweber version, so patch availability is unconfirmed and administrators should monitor the official Microweber release channel directly. As an immediate compensating control, restrict network access to the /api/save_content_admin endpoint at the WAF or reverse-proxy layer to known administrative IP ranges, eliminating the ability of a compromised admin account operating from an unexpected location to stage the injection (trade-off: disrupts legitimate remote admin workflows). Deploy a strict Content Security Policy header with a restrictive script-src directive to limit the blast radius of any stored payload that reaches a visitor's browser - this does not prevent storage but reduces exploitability of execution. At the WAF level, blocking requests to /api/save_content_admin via GET method (since mutations over GET are anomalous) would eliminate this specific bypass vector without impacting standard POST-based workflows. Full technical reproduction detail is available at https://github.com/theopaid/Stored-XSS-via-Content-Tag-Names-Microweber-.
More in Microweber
View allAn authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the ba
Command Injection in GitHub repository microweber/microweber prior to 1.3.3. Rated critical severity (CVSS 9.8), this vu
Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20. Rated critical severity (C
Static Code Injection in GitHub repository microweber/microweber prior to 1.3. Rated critical severity (CVSS 9.8), this
Unauthenticated arbitrary file read in Microweber CMS through version 2.0.20 lets remote attackers retrieve sensitive fi
File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script
Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.
Users Account Pre-Takeover or Users Account Takeover. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior t
An issue was discovered in Microweber 1.0.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Authenticated administrators can execute arbitrary OS commands on Microweber CMS through 2.0.20 by injecting unsandboxed
SQL injection vulnerability in Category.php in Microweber CMS 0.95 before 20141209 allows remote attackers to execute ar
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today