CVE-2026-67617

Received Received - Intake

Stored XSS in Microweber CMS via Tagging System

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulnCheck

Description

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tag_names parameter of the GET /api/save_content_admin endpoint, bypassing three independent sanitization controls including XSS middleware that ignores GET requests, a strip_unsafe() function that only matches double-quoted onerror attributes, and a titlecase normalizer that passes HTML decimal entity-encoded payloads through unchanged. Attackers can store malicious scripts that execute without user interaction for every visitor to the public blog page and within the admin post editor, enabling session riding through same-origin fetch requests using the CSRF token embedded in the page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-03

Generated

2026-08-04

AI Q&A

2026-08-04

EPSS Evaluated

N/A

NVD

CVE-2026-67617

Affected Vendors & Products

Vendor	Product	Version / Range
microweber	microweber	to 2.0.20 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Microweber CMS version 2.0.20. An attacker with admin privileges can inject malicious JavaScript by exploiting the tag_names parameter in the GET /api/save_content_admin endpoint. The payload bypasses multiple sanitization controls, including XSS middleware that ignores GET requests and a strip_unsafe() function that only checks double-quoted onerror attributes.

Detection Guidance

Check for suspicious JavaScript in Microweber CMS content tags by inspecting the tag_names parameter in GET /api/save_content_admin requests. Look for payloads like onerror=alert(1) or HTML entities in stored tags. Review admin post editor and public blog pages for unexpected scripts.

Impact Analysis

An attacker could store malicious scripts that execute automatically for every visitor to the public blog page or within the admin post editor. This enables session hijacking through same-origin fetch requests using the embedded CSRF token, potentially allowing unauthorized actions on behalf of users.

Mitigation Strategies

Upgrade Microweber CMS to the latest version beyond 2.0.20. Disable or restrict access to the /api/save_content_admin endpoint. Implement strict input validation for tag_names parameter. Use CSP headers to block inline scripts. Monitor admin activity for unauthorized tag modifications.

Hi! I’m here to help you understand CVE-2026-67617. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70