CVE-2026-48954

MediumCVSS 6.1/10Last modified Jul 9, 2026

Description

Improper validation leads to a generic XSS vector in the language override feature.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jul 7, 2026
Last modified
Jul 9, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-489556.5An improper access check allows unauthorized users to access workflow stage and transition information.CVE-2026-489565.0An improper access check allows users to display a list of modules in the frontend.CVE-2026-489578.8An improper access check allows unauthorized users to access com_privacy datasets.CVE-2026-489588.8An improper access check allows unauthorized users to create custom fields via webservices endpoints.CVE-2026-489597.5IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares lenCVE-2026-48968.1The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to InsecCVE-2026-489617.3IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix ExCVE-2026-489627.3IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOuCVE-2026-489648.5Subscriber SQL Injection in ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 versions.CVE-2026-489656.5Subscriber Sensitive Data Exposure in XCloner <= 4.8.6 versions.CVE-2026-489667.1Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 versions.CVE-2026-489678.5Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions.
CVE-2026-48954: Medium severity, CVSS 6.1 | Vulnix