CVE-2026-72559
Received Received - Intake

Stored XSS in HortusFox Plant Notes via Parsedown Rendering

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent JavaScript into plant notes via Parsedown rendered without safe mode. Notes are rendered unescaped in the browser of every user who views the affected plant. An attacker can use this to steal session cookies or perform actions in the context of other users including administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72559
EUVD
EUVD-2026-56029

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
danielbrendel hortusfox 5.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in HortusFox 5.9. Authenticated workspace members can inject persistent JavaScript into plant notes. The notes are rendered without safe mode, allowing the injected code to execute in the browser of every user viewing the affected plant. This can lead to session cookie theft or unauthorized actions on behalf of other users, including administrators.

Detection Guidance

To detect this stored XSS vulnerability in HortusFox 5.9, inspect plant notes for JavaScript code or unusual characters. Check browser developer tools for unescaped content in rendered notes. Review database entries in the 'plant_notes' table for injected scripts.

Impact Analysis

An attacker could steal your session cookies, gaining unauthorized access to your account. They could also perform actions as you, including administrative tasks if you have elevated privileges. This could lead to data theft, unauthorized modifications, or further compromise of the system.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized disclosures, and failure to maintain confidentiality, integrity, and availability of sensitive information.

Mitigation Strategies

Update HortusFox to the latest version if available. Disable Parsedown rendering for plant notes or enable safe mode. Sanitize user input in notes fields. Restrict workspace member permissions to minimize attack surface. Monitor for suspicious activity in user sessions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72559. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart