Vulnerability Description
HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of `<iframe>` elements. The application allows `javascript:` URIs in the `src` attribute, which are executed when a malicious page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data exposed to client-side scripts. Version 26.0.0 fixes the issue.
Related Weaknesses (CWE)
References
- https://github.com/haxtheweb/issues/security/advisories/GHSA-jh3h-rpxg-fr36
- https://github.com/haxtheweb/issues/security/advisories/GHSA-jh3h-rpxg-fr36
FAQ
What is CVE-2026-46396?
CVE-2026-46396 is a documented vulnerability. HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of `<iframe>` ele...
How severe is CVE-2026-46396?
CVSS scoring is not yet available for CVE-2026-46396. Check NVD for updates.
Is there a patch for CVE-2026-46396?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.