https://www.cvehunters.com/p/cve-2026-11434/ Cross-Site Scripting (XSS) Stored https://www.cvehunters.com/p/cve-2026-11434/ https://www.cvehunters.com/p/cve-2026-11434/ <h2 id="cve-2026-11434-cross-site-scripting-xss-stored-in-in-endpoint-adminblocks-via-blocks-plugin">CVE-2026-11434: Cross-Site Scripting (XSS) Stored in in endpoint <code>/admin/blocks</code> via <code>Blocks Plugin</code> </h2><blockquote> <p><em><strong>CVE Publication: <a class="link" href="https://www.cve.org/CVERecord?id=CVE-2026-11434" target="_blank" rel="noopener" >https://www.cve.org/CVERecord?id=CVE-2026-11434</a></strong></em></p> </blockquote> <h2 id="summary">Summary </h2><p style="text-align: justify;">A Stored Cross-Site Scripting (XSS) vulnerability was identified in the <code>/admin/blocks</code> endpoint of the FluentCMS application. This vulnerability allows attackers to inject malicious scripts via <code>Blocks Plugin</code>. The injected scripts are stored on the server and executed automatically whenever the main page is accessed by users, posing a significant security risk.</p> <h2 id="details">Details </h2><p>Vulnerable Endpoint: <code>/admin/blocks</code></p><h2 id="cve-2026-11434-cross-site-scripting-xss-stored-in-in-endpoint-adminblocks-via-blocks-plugin">CVE-2026-11434: Cross-Site Scripting (XSS) Stored in in endpoint <code>/admin/blocks</code> via <code>Blocks Plugin</code> </h2><blockquote> <p><em><strong>CVE Publication: <a class="link" href="https://www.cve.org/CVERecord?id=CVE-2026-11434" target="_blank" rel="noopener" >https://www.cve.org/CVERecord?id=CVE-2026-11434</a></strong></em></p> </blockquote> <h2 id="summary">Summary </h2><p style="text-align: justify;">A Stored Cross-Site Scripting (XSS) vulnerability was identified in the <code>/admin/blocks</code> endpoint of the FluentCMS application. This vulnerability allows attackers to inject malicious scripts via <code>Blocks Plugin</code>. The injected scripts are stored on the server and executed automatically whenever the main page is accessed by users, posing a significant security risk.</p> <h2 id="details">Details </h2><p>Vulnerable Endpoint: <code>/admin/blocks</code></p> <p>Parameter: <code>Blocks Plugin</code></p> <h2 id="poc">PoC </h2><h3 id="payload">Payload </h3><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-html" data-lang="html"><span class="line"><span class="cl">"><span class="p"><</span><span class="nt">img</span> <span class="na">src</span><span class="o">=</span><span class="s">x</span> <span class="na">onerror</span><span class="o">=</span><span class="s">alert('CVE-Hunters')</span><span class="p">></span> </span></span></code></pre></td></tr></table> </div> </div><h3 id="steps-to-reproduce">Steps to Reproduce: </h3><p style="text-align: justify;">Access vulnerable endpoint and click on <code>"Add Block"</code> to setup a new entry. Insert the payload in <code>"Content"</code> field, type anything in another fields and click on <code>"Submit"</code>. Access the preview pages by <code>"/?pagePreview=1"</code>, drag and drop the Block Plugin in any place at the page and select the Block that was set up before. Access the Main Page and the script will execute automatically:</p> <p><img src="/p/cve-2026-11434/image.png" width="470" height="582" srcset="/p/cve-2026-11434/image_hu_82c19b5aef121713.png 480w, /p/cve-2026-11434/image_hu_36e0d5133d913b63.png 1024w" loading="lazy" class="gallery-image" data-flex-grow="80" data-flex-basis="193px" /></p> <p><img src="/p/cve-2026-11434/image-1.png" width="678" height="533" srcset="/p/cve-2026-11434/image-1_hu_71e2fb11fbe773fc.png 480w, /p/cve-2026-11434/image-1_hu_b9c46901039d81ea.png 1024w" loading="lazy" class="gallery-image" data-flex-grow="127" data-flex-basis="305px" /></p> <p><img src="/p/cve-2026-11434/image-2.png" width="702" height="278" srcset="/p/cve-2026-11434/image-2_hu_673183fa472bd83c.png 480w, /p/cve-2026-11434/image-2_hu_5dce9ba0cd105845.png 1024w" loading="lazy" class="gallery-image" data-flex-grow="252" data-flex-basis="606px" /></p> <h2 id="impact">Impact </h2><p style="text-align: justify;"> <ul> <li>Session hijacking: Stealing cookies or authentication tokens to impersonate users.</li> <li>Credential theft: Harvesting usernames and passwords using malicious scripts.</li> <li>Malware delivery: Distributing unwanted or harmful code to victims.</li> <li>Privilege escalation: Compromising administrative users through persistent scripts.</li> <li>Data manipulation or defacement: Changing or disrupting site content.</li> <li>Reputation damage: Eroding trust among site users and administrators.</li> </ul> </p> <h2 id="reference">Reference </h2><p><em><strong><a class="link" href="https://github.com/KarinaGante/KG-Sec/blob/main/CVEs/FluentCMS/CVE-2026-11434.md" target="_blank" rel="noopener" >https://github.com/KarinaGante/KG-Sec/blob/main/CVEs/FluentCMS/CVE-2026-11434.md</a></strong></em></p> <h2 id="finder">Finder </h2><p><a class="link" href="https://www.linkedin.com/in/karina-gante/" target="_blank" rel="noopener" ><img src="/assets/contributors/50x50/karina50x50.png" loading="lazy" /></a> <a class="link" href="https://www.linkedin.com/in/karina-gante/" target="_blank" rel="noopener" >Karina Gante</a></p> <blockquote> <p><em><strong>By: <a class="link" href="https://github.com/CVE-Hunters/cve-hunters" target="_blank" rel="noopener" >CVE-Hunters</a></strong></em></p> </blockquote> Sat, 06 Jun 2026 00:00:00 +0000