Reflected XSS in u5CMS via thanks Parameter

Executive Summary

CVE-2026-14449 is a reflected Cross-Site Scripting (XSS) vulnerability in u5CMS versions through 12.8.8. It occurs via the 'thanks' parameter in multiple form components, allowing an attacker to inject malicious scripts that are reflected back to users.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is a reflected Cross-Site Scripting (XSS) issue via the 'thanks' parameter in multiple form components of u5CMS through version 12.8.8.

To detect this vulnerability on your system, you can attempt to send crafted HTTP requests to the affected u5CMS forms that include malicious scripts in the 'thanks' parameter and observe if the script is reflected unescaped in the response.

Example command using curl to test for reflected XSS in the 'thanks' parameter:

• curl -i "http://your-u5cms-site/path/to/form?thanks=<script>alert('XSS')</script>"

If the response contains the injected script tag without proper encoding or sanitization, the site is vulnerable.

Additionally, you can use web vulnerability scanners that support reflected XSS detection targeting the 'thanks' parameter in u5CMS forms.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute malicious scripts in the context of users visiting the affected u5CMS site. This can lead to theft of user credentials, session hijacking, defacement, or redirection to malicious sites, potentially compromising user data and trust.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the reflected XSS vulnerability in u5CMS affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the reflected XSS vulnerability in u5CMS through version 12.8.8, you should upgrade to u5CMS version 12.8.9, which contains a fix for this issue.

Useful 0 Not Useful 0