CVE-2026-46396
NoneCVSS
—
EPSS
0.4%
Published
Jun 5, 2026
CISA due date
—
The record
HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of `<iframe>` elements. The application allows `javascript:` URIs in the `src` attribute, which are executed when a malicious page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data exposed to client-side scripts. Version 26.0.0 fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @haxtheweb/haxcms-nodejs | 0 | 26.0.0 |
| npm | @haxtheweb/iframe-loader | 0 | 26.0.0 |
| npm | @haxtheweb/video-player | 0 | 26.0.0 |
Related vulnerabilities
- GHSA-jh3h-rpxg-fr36 Stored XSS via in HAX CMS allows access to sensitive client-side data and account takeover Same vulnerability
- CVE-2026-46357 HAX CMS helps manage microsite universe with PHP or NodeJs backends. Also affects @haxtheweb/haxcms-nodejs
- CVE-2026-46496 HAX CMS helps manage microsite universe with PHP or NodeJs backends. Also affects @haxtheweb/haxcms-nodejs
- CVE-2026-46511 HAX CMS helps manage microsite universe with PHP or NodeJs backends. Also affects @haxtheweb/haxcms-nodejs
- CVE-2026-46395 HAX CMS helps manage microsite universe with PHP or NodeJs backends. Also affects @haxtheweb/haxcms-nodejs
- CVE-2026-46393 HAX CMS helps manage microsite universe with PHP or NodeJs backends. Also affects @haxtheweb/haxcms-nodejs
- GHSA-g2g8-95qg-v35h HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpoint Also affects @haxtheweb/haxcms-nodejs
- CVE-2026-48527 HAX CMS helps manage microsite universe with PHP or NodeJs backends. Also affects @haxtheweb/haxcms-nodejs