https://www.cvehunters.com/p/cve-2026-12202/ Cross-Site Scripting (XSS) Stored https://www.cvehunters.com/p/cve-2026-12202/ https://www.cvehunters.com/p/cve-2026-12202/ <h2 id="cve-2026-12202-cross-site-scripting-xss-stored-in-in-endpoint-blocks-parameter-css-class-name">CVE-2026-12202: Cross-Site Scripting (XSS) Stored in in endpoint <code>Blocks</code> parameter <code>CSS class name</code> </h2><blockquote> <p><em><strong>CVE Publication: <a class="link" href="https://www.cve.org/CVERecord?id=CVE-2026-12202" target="_blank" rel="noopener" >https://www.cve.org/CVERecord?id=CVE-2026-12202</a></strong></em></p> </blockquote> <h2 id="summary">Summary </h2><p style="text-align: justify;">A Stored Cross-Site Scripting (XSS) vulnerability was identified in the <code>Blocks</code>endpoint of the Subrion CMS application. This vulnerability allows attackers to inject malicious scripts via <code>CSS class name</code> parameter. The injected scripts are stored on the server and executed automatically, posing a significant security risk.</p> <h2 id="details">Details </h2><p>Vulnerable Endpoint: <code>Blocks</code></p> <p>Parameter: <code>CSS class name</code></p><h2 id="cve-2026-12202-cross-site-scripting-xss-stored-in-in-endpoint-blocks-parameter-css-class-name">CVE-2026-12202: Cross-Site Scripting (XSS) Stored in in endpoint <code>Blocks</code> parameter <code>CSS class name</code> </h2><blockquote> <p><em><strong>CVE Publication: <a class="link" href="https://www.cve.org/CVERecord?id=CVE-2026-12202" target="_blank" rel="noopener" >https://www.cve.org/CVERecord?id=CVE-2026-12202</a></strong></em></p> </blockquote> <h2 id="summary">Summary </h2><p style="text-align: justify;">A Stored Cross-Site Scripting (XSS) vulnerability was identified in the <code>Blocks</code>endpoint of the Subrion CMS application. This vulnerability allows attackers to inject malicious scripts via <code>CSS class name</code> parameter. The injected scripts are stored on the server and executed automatically, posing a significant security risk.</p> <h2 id="details">Details </h2><p>Vulnerable Endpoint: <code>Blocks</code></p> <p>Parameter: <code>CSS class name</code></p> <h2 id="poc">PoC </h2><h3 id="payload">Payload </h3><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-html" data-lang="html"><span class="line"><span class="cl">"><span class="p"><</span><span class="nt">img</span> <span class="na">src</span><span class="o">=</span><span class="s">x</span> <span class="na">onerror</span><span class="o">=</span><span class="s">alert('CVE-Hunters2')</span><span class="p">></span> </span></span></code></pre></td></tr></table> </div> </div><h3 id="steps-to-reproduce">Steps to Reproduce: </h3><p style="text-align: justify;">Access admin dashboard and click on <code>"Edit Blocks"</code>. In <code>"Blocks"</code> page, click on <code>"Add Block"</code> button to setup a new entry. Insert the payload in <code>"CSS class name"</code> field, type anything in another fields and click on <code>"Add"</code>. The payload will be activated automatically:</p> <p><img src="/p/cve-2026-12202/image.png" width="665" height="398" srcset="/p/cve-2026-12202/image_hu_2984c7c58cac0ae0.png 480w, /p/cve-2026-12202/image_hu_8a998a312d88a856.png 1024w" loading="lazy" class="gallery-image" data-flex-grow="167" data-flex-basis="401px" /></p> <p><img src="/p/cve-2026-12202/image-1.png" width="690" height="284" srcset="/p/cve-2026-12202/image-1_hu_86e17d63b02dbe9d.png 480w, /p/cve-2026-12202/image-1_hu_2d7f2387cc2508c8.png 1024w" loading="lazy" class="gallery-image" data-flex-grow="242" data-flex-basis="583px" /></p> <h2 id="impact">Impact </h2><p style="text-align: justify;"> <ul> <li>Session hijacking: Stealing cookies or authentication tokens to impersonate users.</li> <li>Credential theft: Harvesting usernames and passwords using malicious scripts.</li> <li>Malware delivery: Distributing unwanted or harmful code to victims.</li> <li>Privilege escalation: Compromising administrative users through persistent scripts.</li> <li>Data manipulation or defacement: Changing or disrupting site content.</li> <li>Reputation damage: Eroding trust among site users and administrators.</li> </ul> </p> <h2 id="reference">Reference </h2><p><em><strong><a class="link" href="https://github.com/KarinaGante/KG-Sec/blob/main/CVEs/SubrionCMS/CVE-2026-12202.md" target="_blank" rel="noopener" >https://github.com/KarinaGante/KG-Sec/blob/main/CVEs/SubrionCMS/CVE-2026-12202.md</a></strong></em></p> <h2 id="finder">Finder </h2><p><a class="link" href="https://www.linkedin.com/in/karina-gante/" target="_blank" rel="noopener" ><img src="/assets/contributors/50x50/karina50x50.png" loading="lazy" /></a> <a class="link" href="https://www.linkedin.com/in/karina-gante/" target="_blank" rel="noopener" >Karina Gante</a></p> <blockquote> <p><em><strong>By: <a class="link" href="https://github.com/CVE-Hunters/cve-hunters" target="_blank" rel="noopener" >CVE-Hunters</a></strong></em></p> </blockquote> Mon, 15 Jun 2026 00:00:00 +0000