CVE-2026-67617

Name of the Vulnerable Software and Affected Versions Microweber CMS versions prior to 2.0.21

Description A stored cross-site scripting issue exists in the content tagging system. Admin-authenticated attackers can inject arbitrary JavaScript via the tag names parameter of the 'GET /api/save content admin' endpoint. This is possible by bypassing three sanitization controls: XSS middleware that ignores GET requests, a strip unsafe() function that only matches double-quoted onerror attributes, and a titlecase normalizer that allows HTML decimal entity-encoded payloads. The injected scripts execute automatically for all visitors to the public blog page and within the admin post editor, allowing session riding through same-origin fetch requests using the CSRF token embedded in the page.

Recommendations Update Microweber CMS to version 2.0.21 or later. As a temporary mitigation, restrict access to the 'GET /api/save content admin' endpoint or avoid using the tag names parameter.