CVE Watch21 jul 2026

CVE-2026-45270

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the `Pages` backend module registers the `html

CVSS

8.7

Alto

EPSS

0.4%

p30

KEV

—

Exploit Today

0-100

Publicado: 20 jul 2026 · Última mod.: 21 jul 2026 · CWE-79

EPSS · 30d

0.2%EPSS · 30 días0.4%

2026-08-202026-09-18

Descripción técnica

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the `Pages` backend module registers the `html_purify` validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages (`Home::index()` → `app/Views/templates/default/pages.php`) emits `$pageInfo->content` without `esc()`, yielding stored XSS that fires for every public visitor of the affected page — including administrators. Because pages may be promoted to the site home page, the payload can be served at `/` and reach every visitor of the site. Version 0.31.9.0 patches the issue.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-929868.8 ALT

35.2%

——11SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to child_process for command execution.1d CVE-2026-634598.7 ALT

22.0%

——7Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and then reading textContent. Active resource markup can execute an event handler during the innerHTML assignment before textContent is read. A lower-privilege administrator can store such markup in descriptions rendered by the Products list, Collections list, Promotions list, Payment Methods list, or Shipping Methods list, and script executes when another administrator views the affected row. This stored cross-site scripting can compromise the viewing administrator's session and enable cross-privilege or cross-channel administrative actions. This issue is fixed in version 3.6.5.23h CVE-2026-909867.1 ALT

7.8%

——2Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions.23h CVE-2026-908877.1 ALT

7.8%

——2Unauthenticated Cross Site Scripting (XSS) in WP Inventory Manager <= 2.5.4 versions.23h CVE-2026-782946.5 MED

5.7%

——2Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.23h CVE-2026-666176.5 MED

5.7%

——2Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.23h