CVE-2026-72559

Name of the Vulnerable Software and Affected Versions HortusFox version 5.9

Description A stored cross-site scripting issue allows authenticated workspace members to inject persistent JavaScript into plant notes. This occurs because Parsedown is rendered without safe mode, causing notes to be rendered unescaped in the browser of any user viewing the affected plant. An attacker can exploit this to steal session cookies or perform actions on behalf of other users, including administrators.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.