CVE-2026-101157

HighCVSS 8.7/10Last modified Oct 7, 2026

Description

A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to compromise the victim's authenticated browser session, access sensitive data, modify system state, or disrupt affected services.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 6, 2026
Last modified: Oct 7, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1011588.4A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execut CVE-2026-1011597.5The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form,CVE-2026-101164.3A security flaw has been discovered in Open5GS up to 2.7.7. This vulnerability affects the function ogs_sbi_xact_add in the library /lib/cor CVE-2026-1011607.5The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later CVE-2026-1011617.5The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes t CVE-2026-1011626.4The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, w CVE-2026-1011653.7The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway CVE-2026-1011663.7The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creating an order fo CVE-2026-1011686.2GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 th CVE-2026-1011698.7In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafte CVE-2026-101174.3A weakness has been identified in Open5GS up to 2.7.7. This issue affects the function ogs_pool_id_calloc in the library /lib/sbi/nghttp2-se CVE-2026-1011704.0DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect availability.