CVE-2016-20098
Awaiting Analysis Awaiting Analysis - Queue

Stored XSS in Reddit Moderator Toolbox

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: VulnCheck

Description
Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cross-site scripting vulnerability in the removalreasons module, which inserts subreddit toolbox wiki fields into popup HTML without encoding. Attackers who can edit the toolbox wiki page can plant JavaScript in fields like pmsubject, header, or reason titles to act with moderators' Reddit sessions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-09
AI Q&A
2026-10-09
EPSS Evaluated
N/A
NVD
CVE-2016-20098
EUVD
EUVD-2016-10914

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
toolbox-team reddit-moderator-toolbox 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the Moderator Toolbox Reddit extension before version 4.0.14. Attackers with wiki editing rights can inject malicious JavaScript into fields like pmsubject, header, or reason titles. The injected script executes in moderators' Reddit sessions, potentially allowing unauthorized actions.

Detection Guidance

Check if the installed version of reddit-moderator-toolbox is below 4.0.14. Review wiki pages for the removalreasons module for suspicious JavaScript in fields like pmsubject, header, or reason titles. Inspect browser console logs for unexpected script executions during moderator actions.

Impact Analysis

If you are a Reddit moderator using the affected toolbox version, an attacker could hijack your session to perform actions like banning users, removing posts, or accessing moderator privileges. Users with wiki editing rights could exploit this to target moderators.

Compliance Impact

This vulnerability primarily involves stored cross-site scripting (XSS) in a Reddit moderator tool, allowing attackers to inject malicious JavaScript into moderators' sessions. While it does not directly impact GDPR or HIPAA compliance, it could lead to unauthorized access to personal data handled by moderators, potentially violating these regulations if sensitive information is compromised.

Mitigation Strategies

Update reddit-moderator-toolbox to version 4.0.14 or later. Remove or restrict edit access to the toolbox wiki page for non-trusted users. Review and sanitize any existing wiki content for injected scripts. Monitor moderator sessions for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2016-20098. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart