PT-2026-89679 · Flextype · Flextype
CVSS v3.1
4.2
Medium
| Vector | AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts in users' browsers when dependency validation fails.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Flextype