CVE-2026-5362
Stored XSS in Pimcore Document Embed Allows Script Execution
Publication date: 2026-04-27
Last updated on: 2026-04-27
Assigner: Fluid Attacks
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pimcore | pimcore | 12.3.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability allows an authenticated attacker who has permission to edit document content to store crafted HTML or JavaScript code within a Document embed editable component.
When the affected page is published and rendered, the malicious script executes, potentially leading to cross-site scripting (XSS) attacks.
How can this vulnerability impact me? :
The vulnerability can lead to the execution of malicious scripts in the context of the published page, which may allow attackers to perform actions such as stealing user session data, defacing content, or conducting further attacks on users viewing the page.