CVE-2026-105124
Received Received - Intake

Stored XSS in wcms via Login and Comment Fields

Publication date: 2026-10-04

Last updated on: 2026-10-04

Assigner: VulnCheck

Description
W (vincent-peugnet/wcms) through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and visitor comment website field. Attackers can submit failed logins rendered unescaped in the adminlog.php log viewer, or comment URLs echoed into href attributes in editrightbar.php, executing script with administrator or editor privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-04
Last Modified
2026-10-04
Generated
2026-10-04
AI Q&A
2026-10-04
EPSS Evaluated
N/A
NVD
CVE-2026-105124
EUVD
EUVD-2026-92044

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vincent-peugnet wcms to 3.18.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in wcms versions up to 3.18.0. Unauthenticated attackers can inject malicious scripts via the login username field or visitor comment field. The injected scripts execute when rendered unescaped in adminlog.php or editrightbar.php, potentially granting attacker privileges.

Detection Guidance

Check for unauthenticated login attempts with script injection in the username field. Inspect adminlog.php for unescaped script tags in failed login entries. Review editrightbar.php for comment URLs echoed into href attributes without proper escaping.

Impact Analysis

Attackers could steal session cookies, perform actions as administrators, or deface the website. Users with admin or editor roles may have their accounts compromised if they view malicious content.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Upgrade wcms to a version beyond 3.18.0. Implement strict input validation for login usernames and comment fields. Ensure all user-supplied data is properly escaped before rendering in adminlog.php and editrightbar.php.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105124. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart