CVE-2026-120488

Name of the Vulnerable Software and Affected Versions LaraDashboard versions prior to 1.4.9

Description A stored cross-site scripting issue exists where authenticated users with post.create or post.edit permissions can inject scripts through unsanitized LaraBuilder design json block content. This occurs when attackers save text-editor, HTML, text, or heading blocks containing script or event-handler markup, which then executes within the sessions of administrators or Superadmins when they view the builder, preview, or page.

Recommendations Update LaraDashboard to version 1.4.9 or later.