GHSA-hrvf-g648-rf3m
Medium · 6.1CVSS
6.1
EPSS
—
Published
Jan 16, 2026
CISA due date
—
The record
PlantUML is vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | net.sourceforge.plantuml:plantuml | 0 | 1.2026.0 |
Related vulnerabilities
- CVE-2026-0858 Versions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable… Same vulnerability
- CVE-2026-62990 Shopper is a Headless e-commerce Admin Panel. CWE-79
- CVE-2026-117645 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')… CWE-79
- CVE-2026-94175 Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions. CWE-79
- CVE-2026-7004 WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site… CWE-79
- CVE-2026-54855 Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions. CWE-79
- CVE-2026-48201 Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions. CWE-79
- CVE-2026-39739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')… CWE-79