CVE-2026-72553
Received Received - Intake

Stored XSS in ElkArte Forum 2.0 Beta 1

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields cust_blurb and cust_locate. The fields are saved without HTML encoding and rendered unescaped in profile views visible to administrators. An attacker can craft a payload that executes in an administrator session, enabling session hijacking or privilege escalation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72553
EUVD
EUVD-2026-56023

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
elkarte elkarte 2.0_beta_1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

A stored cross-site scripting (XSS) vulnerability in ElkArte Forum 2.0 Beta 1 allows registered members to inject persistent JavaScript into profile fields like cust_blurb and cust_locate. These fields are saved without HTML encoding and displayed unescaped in profile views accessible to administrators. An attacker can create a payload that runs in an admin's session, potentially leading to session hijacking or privilege escalation.

Detection Guidance

Check ElkArte profile fields cust_blurb and cust_locate for unescaped JavaScript or unusual content. Manually inspect user profiles for suspicious scripts in these fields. Enable server-side logging to detect unauthorized profile updates.

Impact Analysis

If you are an administrator of an ElkArte Forum 2.0 Beta 1 instance, this vulnerability could allow attackers to execute malicious scripts in your browser when viewing user profiles. This may result in stolen session cookies, unauthorized access to your account, or further compromise of the forum system.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations may face compliance breaches if user data is compromised through such attacks.

Mitigation Strategies

Update ElkArte to the latest patched version. Apply HTML encoding to cust_blurb and cust_locate fields before rendering. Restrict profile editing permissions to trusted administrators. Monitor administrator sessions for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72553. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart