Vulnerability Description
parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those comments, including administrators, enabling session token theft and unauthorized actions.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/parallax/filament-comments/blob/3.0.0/resources/views/comment
- https://github.com/parallax/filament-comments/blob/3.0.0/src/Policies/FilamentCo
- https://hackindex.io/research/stored-xss-filament-comments-unescaped-rendering
- https://packagist.org/packages/parallax/filament-comments
- https://www.vulncheck.com/advisories/parallax-filament-comments-through-3.0.0-st
FAQ
What is CVE-2026-90943?
CVE-2026-90943 is a vulnerability with a CVSS score of 8.7 (HIGH). parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can...
How severe is CVE-2026-90943?
CVE-2026-90943 has been rated HIGH with a CVSS base score of 8.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-90943?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.