Filament Comments
Monthly
Stored cross-site scripting in parallax/filament-comments through 3.0.0 lets an authenticated panel user with comment-posting rights embed JavaScript in a comment body that later executes in the browser of anyone who views that comment, including administrators, enabling session-token theft and unauthorized actions performed as the victim. Exploitation requires a valid Filament admin-panel account (PR:L, authenticated) and depends on a higher-privileged user passively opening the view that renders the comment, so it is not pre-auth reachable; no public exploit code was identified at time of analysis, the issue is not in CISA KEV, and EPSS is only 0.24% (15th percentile). Despite the vendor CVSS 4.0 score of 9.3, the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) frames this as genuine but bounded risk that should be scheduled for prompt remediation rather than treated as an emergency.
Stored cross-site scripting in parallax/filament-comments through 3.0.0 lets an authenticated panel user with comment-posting rights embed JavaScript in a comment body that later executes in the browser of anyone who views that comment, including administrators, enabling session-token theft and unauthorized actions performed as the victim. Exploitation requires a valid Filament admin-panel account (PR:L, authenticated) and depends on a higher-privileged user passively opening the view that renders the comment, so it is not pre-auth reachable; no public exploit code was identified at time of analysis, the issue is not in CISA KEV, and EPSS is only 0.24% (15th percentile). Despite the vendor CVSS 4.0 score of 9.3, the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) frames this as genuine but bounded risk that should be scheduled for prompt remediation rather than treated as an emergency.