Loading story…
LimeSurvey Community Edition 7.0.5+260623 was disclosed with an authenticated reflected cross-site scripting flaw tracked as CVE-2026-63361 in the HTML editor popup endpoint. The vulnerability affects the text and name query parameters, which were filtered with a blacklist-based sanitizer but then rendered without proper context-aware output encoding, allowing attacker-controlled input to be reflected into HTML and script contexts. The issue is classified as CWE-79 and impacts LimeSurvey deployments on Windows, macOS, and Linux.
A security fix was committed in the LimeSurvey GitHub repository under issue #20652, updating application/views/admin/htmleditor/pop_editor_view.php to encode user-controlled values before output. The patch replaces raw rendering of variables including $sFieldText, $sFieldName, $sControlIdEna, and $sControlIdDis with CHtml::encode and CJavaScript::encode, closing the reflected XSS path in the popup rendering and related DOM access logic.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On August 14, 2026, CVE-2026-63361 was newly received for an authenticated reflected XSS vulnerability affecting LimeSurvey Community Edition 7.0.5 on Windows, macOS, and Linux. The flaw involves the HTML editor popup endpoint rendering the text and name parameters without proper context-aware output encoding.
On August 13, 2026, LimeSurvey committed a fix for issue #20652, a reflected XSS vulnerability in the HTML editor popup endpoint. The patch added proper HTML and JavaScript output encoding in pop_editor_view.php and was recorded as commit a8993bfd05c4a11255b8400ed9c41a2c22e93aa4.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcefluidattacks.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TinyMCE has patched multiple cross-site scripting vulnerabilities in its widely deployed rich text editor, including stored and sanitization-related flaws tracked as `CVE-2026-47759`, `CVE-2026-47760`, `CVE-2026-47761`, and `CVE-2026-47762`. The issues could let remote attackers inject malicious JavaScript into web content and compromise active user sessions when affected content is viewed. Reported weaknesses include improper namespace scope handling in the core sanitizer, bypasses involving prefixed attributes and comment handling, and a flaw in the media plugin. The media plugin issue, `CVE-2026-47761`, stems from TinyMCE serializing rich-media elements into placeholder images while preserving raw properties in `data-mce-*` HTML attributes. Because many downstream filters permit arbitrary `data-*` attributes, malicious payloads can survive sanitization, be stored persistently, and later be deserialized into active DOM elements without sufficient validation, triggering script execution in users' browsers. TinyMCE said fixes are available in supported branches and advised customers to upgrade to version `7.9.3` or later or `8.5.1`, while version 5 commercial users may require long-term support updates.
Jun 29, 2026
A vulnerability tracked as **CVE-2026-44990** allows stored cross-site scripting in `sanitize-html` when applications use the library’s default configuration and later render sanitized user content as trusted HTML. The flaw affects versions prior to **2.17.4** and stems from the handling of the disallowed `xmp` element: because `htmlparser2` treats `xmp` as a raw-text tag, attacker-supplied markup inside it is preserved as text during sanitization but can be emitted back as active HTML or JavaScript under the default `disallowedTagsMode: 'discard'` behavior. GitHub’s advisory and the upstream patch say the bypass can let payloads such as `<script>`, `img` event handlers, and `svg`-embedded script content survive filtering and execute in a victim’s browser. The fix in **2.17.4** adds `xmp` to `nonTextTags` so content inside a disallowed `xmp` tag is dropped instead of re-emitted, and regression tests were added to confirm the malicious content is removed. The issue was reported by **Vincenzo Turturro** (`sushi-gif`), and users of affected `sanitize-html` deployments, including those in **ApostropheCMS**, were urged to update immediately.
Jun 29, 2026
Foxit released security updates for *Foxit PDF Editor Cloud* (and related *Foxit eSign* components) to address two **cross-site scripting (XSS)** flaws that could allow **arbitrary JavaScript execution** in a victim’s browser when handling crafted content. The issues are tracked as **CVE-2026-1591** and **CVE-2026-1592** (both **CWE-79**) and were attributed to insufficient input validation and improper output encoding that allowed untrusted data to be embedded into the application’s HTML. The vulnerable functionality includes the **File Attachments list** and **Layers panel**, where attackers could inject payloads via crafted attachment filenames or manipulated layer names inside PDFs, requiring **user interaction** (e.g., opening/interacting with malicious documents) and typically **authenticated** access. Both CVEs are rated **moderate severity** with **CVSS v3.0 6.3**; exploitation could expose sensitive information available to the user’s session (e.g., document contents and session data). Foxit’s guidance is to ensure affected services are updated; the most recent referenced update for PDF Editor Cloud was released **February 3, 2026**.
Jun 29, 2026